[Snort-users] spp_portscan alerts

Jeff Haynie jhaynie at ...710...
Fri Apr 6 14:04:11 EDT 2001


Hello all,

I am receiving spp_portscans from an internal NT machine on our
network.  It is not continuous but happens severl times during the day.
I have searched using google and found several references but nothing
that deals with NT.  I do know that NT is quite chatty and likes to
converse with other NT machines, maybe this is the situation?  Maybe my
Snortbox is picking up the broadcasts?  Ideas, solutions or suggestions
would be greatly appreciated.

Jeff Haynie
CNA, MCSE, SANS Level One GIAC, Chef, Bottlewasher, Golf pro, Swine
jockey, Squirrel trainer, Brain surgeon





More information about the Snort-users mailing list