[Snort-users] spp_portscan behavior is 1.8.6

Ryan Hill rhill at ...2446...
Wed May 22 17:27:08 EDT 2002


Is spp_portscan designed to report STEALTH scan detections regardless of the
preprocessor ignore-hosts directive?

I've got an IP which generates STEALTH packets and spp_portscan is reporting
the event despite the fact the IP is entered into the ignore-hosts list and
am wondering why this activity isn't being ignored.


Ryan Hill
Corporate Information Systems
TeleCommunication Systems, Inc. (TCS) - http://www.telecomsys.com

More information about the Snort-users mailing list