[Snort-users] Snort 2.3 RC1, what right to scan.log?

Matt Kettler mkettler at ...4108...
Tue Nov 30 09:00:05 EST 2004


At 10:57 AM 11/30/2004, Bill Warren wrote:
>In Snort 2.3 RC1, what tells Snort to write to scan.log?  Can you change 
>the name and location of the file?
>Thanks,
>Bill

I suspect that is the portscan2 preprocessor. scan.log is it's default 
filename.

I'd disable portscan2 if your snort.conf still calls it. It's not really 
very useful IMO, and isn't even mentioned in 2.3's snort.conf anymore.

It could also be sfportscan. Looking at it's code however, it's hard to see 
how it works if you don't specify a logfile option.






More information about the Snort-users mailing list