[Snort-users] HP Jetdirect Printers and portscans

Paul Asadoorian paul.com at ...2414...
Fri Jun 29 11:42:08 EDT 2001


I am logging all my HP JetDirect printers (we have many, like 100's) in 
the portscan module:

Jun 29 11:29:17 MY.NET.51.32:161 -> MY.NET.19.248:3649 UDP
Jun 29 11:29:17 MY.NET.51.32:161 -> MY.NET.19.248:3650 UDP
Jun 29 11:29:17 MY.NET.51.32:161 -> MY.NET.19.248:3651 UDP
Jun 29 11:29:17 MY.NET.51.32:161 -> MY.NET.19.248:3652 UDP
Jun 29 11:29:17 MY.NET.51.32:161 -> MY.NET.19.248:3653 UDP
Jun 29 11:29:17 MY.NET.51.32:161 -> MY.NET.19.248:3654 UDP
Jun 29 11:29:17 MY.NET.51.32:161 -> MY.NET.19.248:3655 UDP
Jun 29 11:29:17 MY.NET.51.32:161 -> MY.NET.19.248:3656 UDP
Jun 29 11:29:17 MY.NET.51.32:161 -> MY.NET.19.248:3657 UDP
Jun 29 11:29:17 MY.NET.51.32:161 -> MY.NET.19.248:3658 UDP
Jun 29 11:29:17 MY.NET.51.32:161 -> MY.NET.19.248:3659 UDP
Jun 29 11:29:18 MY.NET.51.32:161 -> MY.NET.19.248:3660 UDP
Jun 29 11:29:18 MY.NET.51.32:161 -> MY.NET.19.248:3661 UDP
Jun 29 11:29:18 MY.NET.51.32:161 -> MY.NET.19.248:3662 UDP
Jun 29 11:29:18 MY.NET.51.32:161 -> MY.NET.19.248:3663 UDP
Jun 29 11:29:18 MY.NET.51.32:161 -> MY.NET.19.248:3665 UDP
Jun 29 11:29:18 MY.NET.51.32:161 -> MY.NET.19.248:3666 UDP
Jun 29 11:29:18 MY.NET.51.32:161 -> MY.NET.19.248:3667 UDP
Jun 29 11:29:18 MY.NET.51.32:161 -> MY.NET.19.248:3668 UDP
Jun 29 11:29:18 MY.NET.51.32:161 -> MY.NET.19.248:3670 UDP
Jun 29 11:29:27 MY.NET.51.32:161 -> MY.NET.19.248:3720 UDP

My portscan settings are as follows:

   preprocessor portscan: $HOME_NET 10 20 portscan.log

Any help is greatly appreciated...

BTW:  MY.NET.51.32 is a Jet Direct Print Server and MY.NET.19.248 is a 
Novell Server

--
Paul Asadoorian, GCIA





More information about the Snort-users mailing list