[Snort-users] Portscan log

francisv at ...6732... francisv at ...6732...
Fri Sep 13 17:16:06 EDT 2002


I have this:

	preprocessor portscan: $HOME_NET 5 5 portscan.log

and I do have portscan.log in /var/log/snort but why am I not seeing it
reported by ACID?

-----Original Message-----
From: John Sage [mailto:jsage at ...2022...] 
Sent: Friday, September 13, 2002 8:58 PM
To: francisv at ...6732...
Cc: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] Portscan log

On Fri, Sep 13, 2002 at 10:55:04AM +0800, francisv at ...6732... wrote:
> Hi,
> 
> How do I log portscans in the SQL database?
> 
> ---
>  francis a. vidal [bitstop network services] | http://www.bitstop.ph
>  streaming media + web hosting               | http://www.keystone.ph
>  v(02)330-2871,(02)330-2872; f(02)330-2873   | http://www.kuro.ph 

umm..

Are they *not* being logged?

Are you saying this:

<snip>
# portscan: detect a variety of portscans
# ---------------------------------------
# portscan preprocessor by Patrick Mullen <p_mullen at ...245...>
# This preprocessor detects UDP packets or TCP SYN packets going to
# four different ports in less than three seconds. "Stealth" TCP
# packets are always detected, regardless of these settings. 

preprocessor portscan: $HOME_NET 4 3 portscan.log
# keep as from 1.8.4
<snip>

In your snort.conf?


For me, this creates a text log in my snort logging directory, and an
alert goes into the database, as well...

...I'm not aware that you need to do more.




More information about the Snort-users mailing list