[Snort-users] Portscan Preprocessor...

Joe McAlerney joey at ...47...
Wed May 9 14:34:22 EDT 2001


It was recently added:

http://www.snort.org/FAQ.html#q67

-Joe M.

-- 
|   Joe McAlerney     joey at ...155...   |
| Silicon Defense - Technical Support for Snort |
|       http://www.silicondefense.com/          |
+--                                           --+

Steve Halligan wrote:
> 
> > Hi all.
> >
> > Just updated snort from 1.7 to 1.8beta something last week. I used to
> > log alerts into a MySQL database which schema came with snort tarball.
> > With 1.7 I saw portscan reports logged into the DB, but now with 1.8 I
> > do not see anything logged from this preprocessor.
> > The link to Patrick Mullen homepage seems to be broken and I just
> > wondered how I have to specify snort to log this preprocessor's result
> > into the DB. Seems that "preprocessor portscan 4 3 $HOME_NET " does
> > nothing...
> >
> > Thanks.
> 
> To quote myself "This really needs to be in the FAQ"




More information about the Snort-users mailing list