[Snort-users] Denmarc/Snort and portscans

Lists lists at ...3351...
Thu Oct 25 18:11:01 EDT 2001


I am lighting off a portscan on my home_net and nothing is popping up on
Demarc or getting logged to /var/log/snort/portscan.log

The machine I am launching the scan from is on my home_net subnet.  I
notice in the snort.conf portscan preprocessor:

preprocessor portscan: $HOME_NET 4 3 portscan.log

I have tried changing the value to: "any" (no quotes) with no luck.

Anybody have any thoughts?



More information about the Snort-users mailing list