[Snort-users] spp_portscan and ACID
jyates at ...5449...
Mon Apr 1 12:40:55 EST 2002
In ACID, I get warned of portscan scan events like this.
spp_portscan: End of portscan from 10.165.21.21: TOTAL time(14s)
hosts(41) TCP(1) UDP(43)
For some reason, when I click to see the event I can't see whom
10.165.21.21 is scanning. If I check the portscan.log file. I have
logs like this
Apr 1 14:38:58 10.165.21.21:1052 -> 10.217.5.32:38293 UDP
Apr 1 14:38:58 10.165.21.21:1052 -> 10.217.5.76:38293 UDP
How can I get those events to show up in ACID?
More information about the Snort-users