[Snort-users] portscan2-ignorehosts & portscan-ignorehosts

Distribution Lists dist-lists at ...7559...
Mon Dec 2 11:54:05 EST 2002


I added these preprocessors using SnortCenter 0.9.6
But aren't the rule in the wrong order ?

preprocessor portscan2: scanners_max 3200, targets_max 5000, target_limit
5, port_limit 20, timeout 60
preprocessor portscan-ignorehosts: 24.167.76.32
preprocessor portscan: $HOME_NET 4 3 portscan.log
preprocessor portscan2-ignorehosts:  24.167.76.32


Shouldn't the 'portscan-ignorehosts' be after 'preprocessor portscan' ?

> Why are you using both spp_portscan and spp_portscan2 ?

I only just moved to 1.9.0, I was using 1.8.6 before, and had spp_portscan
configured. I wasn't sure which was the better, so I configured both :)

What is the better, spp_portscan or spp_portscan2 ?

Regards

> Your alert came from spp_portscan, add the following to that line:
> preprocessor portscan-ignorehosts: 24.167.76.32/32
>
> Or the following for spp_portscan2
> preprocessor portscan2-ignorehosts: 34.167.76.32/32
>
> Why are you using both spp_portscan and spp_portscan2 ?
>
> Cheers!
>
>     - Alberto
>
> Distribution Lists wrote:
>
>>I have this in my snort.conf
>>
>>preprocessor portscan2: scanners_max 3200, targets_max 5000,
>> target_limit 5, port_limit 20, timeout 60
>>preprocessor portscan-ignorehosts: 24.167.76.32
>>preprocessor portscan: $HOME_NET 4 3 portscan.log
>>preprocessor portscan2-ignorehosts:  24.167.76.32
>>
>>but I still getting
>>
>>[**] [100:1:1] spp_portscan: PORTSCAN DETECTED from 24.167.76.32
>>(THRESHOLD 4 connections exceeded in 0 seconds) [**]
>>
>>So any ideas what I have missed ?
>>
>>Regards
>>
>>
>>
>>
>>
>
> --
> The secret to success is to start from scratch and keep on scratching.
>
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: Get the new Palm Tungsten T
> handheld. Power & Color in a compact size!
> http://ads.sourceforge.net/cgi-bin/redirect.pl?palm0002en
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users







More information about the Snort-users mailing list