[Snort-users] Portscan 2 question

Joe Giles jgiles at ...6534...
Thu Oct 24 10:22:08 EDT 2002


I have a weird problem with 2 entries in my ACID database. Apparently,
my server did a port scan on a remote machine. The problem is that no
one here initiated a port scan. The database lists my server IP as the
source and lists a dest IP. This is listed as a spp_portscan2. Does the
new snort scan other machines on the Internet? I don't want any issues
with other services because they think I'm port scanning their network.

Thanks

Joe







More information about the Snort-users mailing list