[Snort-users] ACID Portscan Traffic (0%)
rdesmond at ...6547...
Tue Dec 17 07:42:30 EST 2002
At 03:23 PM 12/11/2002 -0500, Luo, Philip wrote:
>I am having the same problem. I did check the acid_conf.php file, it looks
>ok, and my scan.log is getting bigger, which ACID can not show.
There are a couple issues here, and Roman (or anyone on the acidlabs team)
should correct me if they are incorrect.
1) ACID's portscan meter on the home page only works if you have 'log'
instead of 'alert' for the DB output plugin, since that is the only way to
get the portscan/2 preprocessor-generated messages, otherwise they just get
put in the scan.log file, and ACID doesn't use that for the meter.
2) You can see the portscan activity with ACID. When you examine a specific
IP, there is the option in the upper right corner to "view events ...
Portscan". Clicking that lets you see the portscan events for that host.
3) Currently, the scan.log is in a different format than ACID expects.
(Change from 1.8.x to 1.9.x) You can't actually see the portscan events,
but you can see if the table has any rows and then grep the addy out of
your scan.log by hand. (Yes it's messy. If you really have a problem, join
the acidlabs development team.)
In the end, remember that I am just an ACID user, not a developer, so
someone involved with the project might have more info.
UCSB Extended Learning Services
More information about the Snort-users