[Snort-users] As a newbie, two questions
Keith.McCammon at ...3497...
Fri May 3 08:35:03 EDT 2002
Assuming that 1) you're HOME_NET variable is set correctly, and 2) your sensor is properly placed on a monitoring port on your switch, then snort should detect nmap scans destined for any machine within the HOME_NET scope.
And you can start snort from the command line and see which include files are loading, as well as the total number of rules loaded at initialization.
From: Emanuele Salvador [mailto:lele at ...5772...]
Sent: Friday, May 03, 2002 11:25 AM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] As a newbie, two questions
I recently installed on a Linux box (Redhat 7.2) snort and acid, following
the instructions (kindly provided on
http://www.sfhn.net/whites/snort_acid-rpm.html) by Mr. Mark Johnson.
The installation went straightforward and everything seems to work. But...
1) snort seems to detect portscans from nmap only on the host where snort
runs. Is this a normal behaviour? It is not clear for me if snort should
detect portscans on all the net (or if it should not detect portscans at
2) I've not been able to verify if my snort.conf loads correctly. Is there
a way to see what rules are loaded?
Thanks to all,
"The stars are matter, we're matter. But it doesn't matter."
- Don Van Vliet -
Have big pipes? SourceForge.net is looking for download mirrors. We supply
the hardware. You get the recognition. Email Us: bandwidth at ...382...
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:
More information about the Snort-users