[Snort-users] spp_portscan2 proxy alerts

Erek Adams erek at ...950...
Mon Jan 13 23:14:06 EST 2003


On Mon, 13 Jan 2003 gr8dane2 at ...163... wrote:

> If this message gets posted twice, I'm sorry, I accidently sent it from
> a different address and it got held.  (Ok, I'll drink!)

Damn....  And I thought I was gonna get someone on that new one!  ;-)

>
> Hello, I'm trying to eliminate some false alerts and I know this one has
> been discussed, but I seem to be finding conflicting information and
> would like to know what your thoughts are.  First, my setup:

[...excellent info snipped...]

> I get about 10 or 12 an hour.  I have found many references to this
> situation.  I have followed much of the advice, but seem to find myself
> chasing my tail.  I have configured spp_portscan to ignore hosts and
> specified my BM, but this had no effect on portscan2.  I have put the
> same ignore hosts command for the portscan2 as someone had suggested,
> but that didn't work either.  The only thing I haven't tried yet, was
> someone suggested downloading his personal code that would allow you to
> do an ignore ports setting for portscan2.  It involves compiling the
> software which I am unfamiliar with.  That's why I used the binary on
> Windows.  Not to mention, I am a little weary about trusting such a
> situation.  Any help would be greatly appreciated!  Also, thank you all
> for contributing so much!  The archives have already solved many
> problems for me.

I'm not a Code God, or even a Code Demi-God.  :)  But, IIRC, the
ignorehosts in portscan2 is a bit broken.  :-/  I'll have to have a look
at it and pray I understand it.  ;-)

You might want to try using this [0] to ignore things from a host.  It
works very well on a *NIX or *BSD platform

Good luck!  Take care!

-----
Erek Adams

   "When things get weird, the wierd turn pro."   H.S. Thompson


[0]	http://www.theadamsfamily.net/~erek/snort/




More information about the Snort-users mailing list