[Snort-users] spp_portscan to port 80

Nicky Davey daveyn2002 at ...3162...
Thu Feb 21 10:18:04 EST 2002


Thanks, i did have my home net set to any.

So why would it think port 80 traffic is a port scan?

 --- Paul Keser <pkeser at ...4934...> wrote: >
-----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> I saw a lot of these types of alerts until I defined
> my HOME_NET variable.
> 
> - -PaulK
> 
> 
> On Thursday 21 February 2002 08:48, you wrote:
> > Hi,
> >
> > I have set up snort and my portscan.log file is
> full
> > of spp_portscans from my internal addresses to
> outside
> > addresses on port 80. I put this down to normal
> http
> > traffic, is it normal and why does it happen?
> >
> > Thank you.
> >
> > http://movies.yahoo.com.au - Yahoo! Movies
> > - Vote for your nominees in our online Oscars
> pool.
> >
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users at lists.sourceforge.net
> > Go to this URL to change user options or
> unsubscribe:
> >
>
https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> >
>
http://www.geocrawler.com/redir-sf.php3?list=snort-users
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.0.6 (GNU/Linux)
> Comment: For info see http://www.gnupg.org
> 
>
iD8DBQE8dTR6txLIMhQSDIERAmdyAKCTz9imEulaPDXz6HuyiqDda3vuhgCgm2FC
> pQfLH/pY6RYcTAH9r7V+4pA=
> =UpHf
> -----END PGP SIGNATURE----- 

http://movies.yahoo.com.au - Yahoo! Movies
- Vote for your nominees in our online Oscars pool.




More information about the Snort-users mailing list