[Snort-users] Portscan Module Tweaking

Paul Asadoorian Paul_Asadoorian at ...2414...
Wed Oct 17 06:31:24 EDT 2001


I am currently using snort to monitor a 130mb link, load balanced across 3
sensors reporting back to a central database.  I have the following issues
when I activate the portscan module:

1. No matter how I tweak the ports per second settings (4 3, 4 2, 7 2) I
still get false positives from load balancers on port 6709.
2. I also get many false positives that look like this:

Oct 16 11:00:00 192.193.195.132:80 -> MY.NET.68.35:1994 INVALIDACK ***A*R*F

I assume that this is caused by a load balancer as well.

Any suggestions on how to handle these problems?  I can keep adding IP
addresses to the ignore hosts until I am blue in the face, but that doesn't
really solve the problem.  <Feature Request> It would be nice if I could add
ports to the ignore list (both source and destination) to help weed out the
false positives </Feature Request>.

Thanks,

Paul Asadoorian, GCIA
Brown University






More information about the Snort-users mailing list