[Snort-users] spp_portscan and ACID

Jason Yates jyates at ...5449...
Mon Apr 1 12:40:55 EST 2002

In ACID, I get warned of portscan scan events like this.

spp_portscan: End of portscan from TOTAL time(14s)
hosts(41) TCP(1) UDP(43)

For some reason, when I click to see the event I can't see whom is scanning.  If I check the portscan.log file.  I have
logs like this

Apr  1 14:38:58 -> UDP  
Apr  1 14:38:58 -> UDP

How can I get those events to show up in ACID?

-Jason Yates

More information about the Snort-users mailing list