[Snort-users] Re: Syn scan not logged

Martin Roesch roesch at ...421...
Thu Mar 22 01:13:55 EST 2001


Was the $HOME_NET variable set to match your external interface IP
address?  Was the portscan detector properly tweaked to be able to pick
up a portscan with the packet frequency that's being sent by the
scanning site, etc?

    -Marty 

salz wrote:
> 
> Hi ,
> 
>  I am using snort-1.7 and the default vision.conf .. It works just fine or so i
> thought .
> 
>  I visited this site http://dslreports.com/scan   , they have an applet there
> that scans your system and gives you a summary. I ran the scan but snort did
> not report anything ..
> 
> On another machine i have IPchains , i ran the same scan on that machine and
> the scan was logged..
> 
> I run snort using the command
> 
> snort -b -c /var/adm/snort-1.7/snort.conf -D -i eth0 -l /var/log  -s
> 
> Thanks for the help
> 
> sebastian lawrence
> 
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users

--
Martin Roesch
roesch at ...421...
http://www.snort.org




More information about the Snort-users mailing list