[Snort-users] search by port in ACID

Mark Rowlands fuc952d at ...4457...
Sat Mar 9 14:21:02 EST 2002


On Saturday 09 March 2002 12:26 am, Roelof JT Jonkman wrote:
> Michael,
>
> > Is there a way to specify a port when doing a search in ACID?  I want to
> > search for all alerts going to destination ports 137 and 139 but the
> > search page does not seem to have an option to search by port.
>
> Isn't quite straightforward, however, on the main screen, select 'source
> ports' or 'destination ports', go to port 137 or 139, and click on the
> number that is under the column 'occurences'.
>
> That gives you a list of alerts for the chosen port. It quite what you're
> asking for, however it might do the job for you.
>
> Roel Jonkman
> Security Engineer
> http://www.SiliconDefense.com
>

dont know which version you're running but on mine  cvsupped today ..... 
if you press that little layer four button you get lots of jolly oprions 
including port... src or dest.





More information about the Snort-users mailing list