[Snort-users] spp_portscan and ACID

Jason Yates jyates at ...5449...
Mon Apr 1 12:40:55 EST 2002


In ACID, I get warned of portscan scan events like this.

spp_portscan: End of portscan from 10.165.21.21: TOTAL time(14s)
hosts(41) TCP(1) UDP(43)

For some reason, when I click to see the event I can't see whom
10.165.21.21 is scanning.  If I check the portscan.log file.  I have
logs like this

Apr  1 14:38:58 10.165.21.21:1052 -> 10.217.5.32:38293 UDP  
Apr  1 14:38:58 10.165.21.21:1052 -> 10.217.5.76:38293 UDP

How can I get those events to show up in ACID?


-Jason Yates





More information about the Snort-users mailing list