[Snort-users] Tcp portscans

Lee Clemens snort at ...13080...
Wed Feb 23 11:48:58 EST 2005


Hello everyone,

I have been noticing a lot of alerts and logged packets with the title "TCP
Portscan", but when I look at Ethereal (running all the time) I can't seem
to find any packets similar to the ones logged. The full alert is

[122:1:0] (portscan) TCP Portscan {PROTO255} ExternalIP ->
IPofLocalDMZ.Computer

I have also seen a lot of packets logged with Info: Bogus IP length (14,
less than header length 20), but Ethereal does not see these on the regular
recording either.

Another interesting point is that the logged packets always have the same
Src and Dst MAC addresses (which isn't on my local network) but with a Src
IP address that I will see traffic from occasionally (legitamate), but not
with the DMZ.Computer. The Bogus IP length packets are logged as a response
to the "Portscan" but with no IP addresses (only the same MAC Src and Dst).

I'd really appreciate any help about this, I don't think it's anything from
my snort.conf file, but I am running:
preprocessor sfportscan: proto  { all } \
                         memcap { 10000000 } \
                         sense_level { low }

Thanks for any advice you can give me!

Lee Clemens
snort at ...13080...

{
I'm running Snort 2.3
Windows XP Pro SP2
Ethereal 10.9
WinPcap 3.0alpha3
}






More information about the Snort-users mailing list