[Snort-users] end of portscan

Simon Frohn sf at ...1883...
Tue May 8 18:37:23 EDT 2001


Hi,

how does the spp exactly detect the end of
a portscan? If all ports in a certain range have
been scanned? timout?
I am currently testing with nmap. Doing a http-request
after 3 hours still reveals a "spp_portscan status from ...."

thanks,
Simon  





More information about the Snort-users mailing list