[Snort-users] spp_portscan and ACID

Estes, Matt: CPR / FCBS Matt.Estes at ...5454...
Tue Apr 2 01:47:31 EST 2002

That's because the default logging for spp_portscan doesn't log the packet
info.  I'm new to this list, so don't let me reinvent the wheel here.  I had
to mod the spp_portscan.c file to support basic portscan logging to a

 - Removed the IP/time/host information from the event header that generates
unique events for every portscan you see.
 - Changed event logging to Log and not the default of Alert so that it
works like other database event loggers.
 - Added packet logging (replace NULL with "p" in the logger call)

This is not pretty yet and only shows my the indication of a portscan with 1
packet of info, still working on making it more complete.

Again, has this already been done?


-----Original Message-----
From: Jason Yates [mailto:jyates at ...5449...]
Sent: Monday, April 01, 2002 3:23 PM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] spp_portscan and ACID

In ACID, I get warned of portscan scan events like this.

spp_portscan: End of portscan from TOTAL time(14s)
hosts(41) TCP(1) UDP(43)

For some reason, when I click to see the event I can't see whom is scanning.  If I check the portscan.log file.  I have
logs like this

Apr  1 14:38:58 -> UDP  
Apr  1 14:38:58 -> UDP

How can I get those events to show up in ACID?

-Jason Yates

Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

More information about the Snort-users mailing list