[Snort-users] Denmarc/Snort and portscans
lists at ...3351...
Thu Oct 25 18:11:01 EDT 2001
I am lighting off a portscan on my home_net and nothing is popping up on
Demarc or getting logged to /var/log/snort/portscan.log
The machine I am launching the scan from is on my home_net subnet. I
notice in the snort.conf portscan preprocessor:
preprocessor portscan: $HOME_NET 4 3 portscan.log
I have tried changing the value to: "any" (no quotes) with no luck.
Anybody have any thoughts?
More information about the Snort-users