[Snort-users] Portscan False Positives From My IP Range
Vintinner, M. Scott
scottv at ...8558...
Mon Apr 7 13:28:09 EDT 2003
I'm getting a lot of portscans in my alert file where the source is my
network. In this example, it looks like a user behind my firewall is simply
accessing a website:
[**] [117:1:1] (spp_portscan2) Portscan detected from 184.108.40.206: 21
targets 21 ports in 6 seconds [**]
04/07-16:22:07.580527 0:A0:8E:E:43:48 -> 0:B0:64:54:8A:21 type:0x800
220.127.116.11:25320 -> 18.104.22.168:80 TCP TTL:127 TOS:0x0 ID:45683
IpLen:20 DgmLen:44 DF
******S* Seq: 0x1AC9FB Ack: 0x0 Win: 0x2000 TcpLen: 24
TCP Options (1) => MSS: 1460
In my snort.conf file, my networks are configured so I would think portscan2
would ignore the traffic since its source is in HOME_NET.
var HOME_NET 22.214.171.124/24
var EXTERNAL_NET !126.96.36.199/24
Will the #preprocessor portscan-ignorehosts: 0.0.0.0 line work for
M. Scott Vintinner
Senior Systems Engineer
Robinson Bradshaw & Hinson, P.A.
101 N. Tryon St., Suite 1900
Charlotte, NC 28246
mailto:scottv at ...8558...
More information about the Snort-users