[Snort-users] search by port in ACID
fuc952d at ...4457...
Sat Mar 9 14:21:02 EST 2002
On Saturday 09 March 2002 12:26 am, Roelof JT Jonkman wrote:
> > Is there a way to specify a port when doing a search in ACID? I want to
> > search for all alerts going to destination ports 137 and 139 but the
> > search page does not seem to have an option to search by port.
> Isn't quite straightforward, however, on the main screen, select 'source
> ports' or 'destination ports', go to port 137 or 139, and click on the
> number that is under the column 'occurences'.
> That gives you a list of alerts for the chosen port. It quite what you're
> asking for, however it might do the job for you.
> Roel Jonkman
> Security Engineer
dont know which version you're running but on mine cvsupped today .....
if you press that little layer four button you get lots of jolly oprions
including port... src or dest.
More information about the Snort-users