[Snort-users] portscan preprocessor and scan rules

Fabrizio Tivano fabrizio at ...7792...
Thu Apr 24 02:11:16 EDT 2003


Hello dear all, 

I have one question using spp_portscan preprocessor:

When scan preprocessor is enabled I see on my logs the spp_portscan messages,
if i disable the preprocessor, what's happen?
snort use the scan-rules  in order to make the same thing ?
or this king of scan (logged by preprocessor)
cannot be seen? 


TIA
fabrizio




More information about the Snort-users mailing list