[Snort-users] Database Plugin - Alert vs. Log

L. Christopher Luther CLuther at ...6333...
Mon Dec 2 09:41:52 EST 2002


Always an option, but then again, that's what the portscan plugin is for.
Why reinvent the wheel?  Better have the portscan plugin normalized to
produce consistent output.  

-----Original Message-----
From: Frank Knobbe [mailto:fknobbe at ...652...]
Sent: Wednesday, November 27, 2002 7:34 PM
To: L. Christopher Luther
Cc: 'Erek Adams'; Snort-Users (E-mail)
Subject: RE: [Snort-users] Database Plugin - Alert vs. Log


On Wed, 2002-11-27 at 17:04, L. Christopher Luther wrote:
> When o when will the portscan data be normalized so that it can
> cleanly be put into a database?!  Sigh...  

Why don't you write some Snort rules that detect portscans? Create rules
that fire when unused IP's are accessed, and/or when used ports (on used
IP's) are accessed. That way you have the scan in a normal format in the
database.

Frank

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20021202/96861603/attachment.html>


More information about the Snort-users mailing list