[Snort-users] Portscan Module Tweaking
Paul_Asadoorian at ...2414...
Wed Oct 17 06:31:24 EDT 2001
I am currently using snort to monitor a 130mb link, load balanced across 3
sensors reporting back to a central database. I have the following issues
when I activate the portscan module:
1. No matter how I tweak the ports per second settings (4 3, 4 2, 7 2) I
still get false positives from load balancers on port 6709.
2. I also get many false positives that look like this:
Oct 16 11:00:00 188.8.131.52:80 -> MY.NET.68.35:1994 INVALIDACK ***A*R*F
I assume that this is caused by a load balancer as well.
Any suggestions on how to handle these problems? I can keep adding IP
addresses to the ignore hosts until I am blue in the face, but that doesn't
really solve the problem. <Feature Request> It would be nice if I could add
ports to the ignore list (both source and destination) to help weed out the
false positives </Feature Request>.
Paul Asadoorian, GCIA
More information about the Snort-users