[Snort-users] portscan2-ignorehosts & portscan-ignorehosts

Robby Desmond rdesmond at ...6547...
Mon Dec 2 12:09:20 EST 2002


At 01:37 PM 12/2/2002 -0800, Alberto Gonzalez wrote:
>Your alert came from spp_portscan, add the following to that line:
>preprocessor portscan-ignorehosts: 24.167.76.32/32

Umm, the actual problem is that his portscan-ignorehosts needs to be 
*after* his initial portscan line.


>Or the following for spp_portscan2
>preprocessor portscan2-ignorehosts: 34.167.76.32/32
>
>Why are you using both spp_portscan and spp_portscan2 ?

Yeah. That is a good question. Why?


>Cheers!
>
>    - Alberto
>
>Distribution Lists wrote:
>
>>I have this in my snort.conf
>>
>>preprocessor portscan2: scanners_max 3200, targets_max 5000, target_limit
>>5, port_limit 20, timeout 60
>>preprocessor portscan-ignorehosts: 24.167.76.32
>>preprocessor portscan: $HOME_NET 4 3 portscan.log
>>preprocessor portscan2-ignorehosts:  24.167.76.32
>>
>>but I still getting
>>
>>[**] [100:1:1] spp_portscan: PORTSCAN DETECTED from 24.167.76.32
>>(THRESHOLD 4 connections exceeded in 0 seconds) [**]
>>
>>So any ideas what I have missed ?
>>
>>Regards
>>
>>
>>
>>
>
>--
>The secret to success is to start from scratch and keep on scratching.
>
>
>
>
>-------------------------------------------------------
>This SF.net email is sponsored by: Get the new Palm Tungsten T handheld. 
>Power & Color in a compact size! 
>http://ads.sourceforge.net/cgi-bin/redirect.pl?palm0002en
>_______________________________________________
>Snort-users mailing list
>Snort-users at lists.sourceforge.net
>Go to this URL to change user options or unsubscribe:
>https://lists.sourceforge.net/lists/listinfo/snort-users
>Snort-users list archive:
>http://www.geocrawler.com/redir-sf.php3?list=snort-users


Robert Desmond
Systems Administrator
UCSB Extended Learning Services
805-893-4906





More information about the Snort-users mailing list