[Snort-users] spp_portscan and ACID
Estes, Matt: CPR / FCBS
Matt.Estes at ...5454...
Tue Apr 2 01:47:31 EST 2002
That's because the default logging for spp_portscan doesn't log the packet
info. I'm new to this list, so don't let me reinvent the wheel here. I had
to mod the spp_portscan.c file to support basic portscan logging to a
- Removed the IP/time/host information from the event header that generates
unique events for every portscan you see.
- Changed event logging to Log and not the default of Alert so that it
works like other database event loggers.
- Added packet logging (replace NULL with "p" in the logger call)
This is not pretty yet and only shows my the indication of a portscan with 1
packet of info, still working on making it more complete.
Again, has this already been done?
From: Jason Yates [mailto:jyates at ...5449...]
Sent: Monday, April 01, 2002 3:23 PM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] spp_portscan and ACID
In ACID, I get warned of portscan scan events like this.
spp_portscan: End of portscan from 10.165.21.21: TOTAL time(14s)
hosts(41) TCP(1) UDP(43)
For some reason, when I click to see the event I can't see whom
10.165.21.21 is scanning. If I check the portscan.log file. I have
logs like this
Apr 1 14:38:58 10.165.21.21:1052 -> 10.217.5.32:38293 UDP
Apr 1 14:38:58 10.165.21.21:1052 -> 10.217.5.76:38293 UDP
How can I get those events to show up in ACID?
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:
More information about the Snort-users