[Snort-users] portscan events not showing up in base
jnn at ...13788...
Tue May 23 09:06:31 EDT 2006
I'm using snort 2.4.4 but not sfportscan, rather the older portscan and
portscan2 modules. I've just realized that, although portscans are
being detected just fine, they aren't being propagated through barnyard
into the base database.
select * from acid_event where sig_name like '%portscan%' and timestamp >
If I change the date portion to sometime last month, before I switched
from sfportscan, I get all sorts of results. Does anyone have any clue
what might be causing this?
Systems Administrator, WebXess Inc.
More information about the Snort-users