[Snort-users] Portscan False Positives From My IP Range

Vintinner, M. Scott scottv at ...8558...
Mon Apr 7 13:28:09 EDT 2003


I'm getting a lot of portscans in my alert file where the source is my
network.  In this example, it looks like a user behind my firewall is simply
accessing a website:

[**] [117:1:1] (spp_portscan2) Portscan detected from 64.132.107.3: 21
targets 21 ports in 6 seconds [**]
04/07-16:22:07.580527 0:A0:8E:E:43:48 -> 0:B0:64:54:8A:21 type:0x800
len:0x3C
64.132.107.3:25320 -> 207.171.182.23:80 TCP TTL:127 TOS:0x0 ID:45683
IpLen:20 DgmLen:44 DF
******S* Seq: 0x1AC9FB  Ack: 0x0  Win: 0x2000  TcpLen: 24
TCP Options (1) => MSS: 1460


In my snort.conf file, my networks are configured so I would think portscan2
would ignore the traffic since its source is in HOME_NET.

var HOME_NET 64.132.107.0/24
var EXTERNAL_NET !64.132.107.0/24

Any suggestions?

Will the #preprocessor portscan-ignorehosts: 0.0.0.0 line work for
portscan2?

M. Scott Vintinner
Senior Systems Engineer
Robinson Bradshaw & Hinson, P.A.
101 N. Tryon St., Suite 1900
Charlotte, NC 28246
(704) 377-8189
mailto:scottv at ...8558...




More information about the Snort-users mailing list