[Snort-users] spp_portscan2 and 2.0.6

Ron Shuck rshuck at ...6736...
Tue Dec 30 07:54:48 EST 2003

Hi All,

I just upgraded to 2.0.6 (yes I know 2.1 is out, but baby steps) on Red
Hat 9. I started noticing that the signature string changed for
portscans, it reads "spp\_portscan2". This breaks how ACID handles
portscans. I took a quick grep in the source, but didn't find anything.

Any ideas on how to fix this, or is it fixed it 2.1?

Ron Shuck, CISSP, GCIA, CCSE - Managing Consultant 
Buchanan Associates - A Technology Company in the People Business 

More information about the Snort-users mailing list