[Snort-users] spp_portscan behavior is 1.8.6
rhill at ...2446...
Wed May 22 17:27:08 EDT 2002
Is spp_portscan designed to report STEALTH scan detections regardless of the
preprocessor ignore-hosts directive?
I've got an IP which generates STEALTH packets and spp_portscan is reporting
the event despite the fact the IP is entered into the ignore-hosts list and
am wondering why this activity isn't being ignored.
Corporate Information Systems
TeleCommunication Systems, Inc. (TCS) - http://www.telecomsys.com
More information about the Snort-users