[Snort-users] Re: [Snort-devel] portscan events not showing up in base

John Newman jnn at ...13788...
Tue May 23 10:50:12 EDT 2006


Didn't seem to do the trick...   anyone have any other ideas?   

Also, I tried switching it from portscan2.log to portscan.log,
rebuilding my alert cache in base, a few other things... still can't get
portscans to show up.

thanks
--

John

On Tue, May 23, 2006 at 12:25:55PM -0500, John Newman wrote:
> Could this be the answer to my problem:
> 
> base_conf.php has this setting, which I just set:
> 
> /* Snort spp_portscan log file */
> $portscan_file = '/var/log/snort/portscan2.log';
> 
> Maybe this will do the trick!
> 
> On Tue, May 23, 2006 at 12:05:16PM -0500, John Newman wrote:
> > Oh, looks like this is for for flow-portscan, which I'm not using.
> > Maybe I should?   How does it compare to sfportscan and portscan2 in
> > people's experience?
> > 
> > --
> > John
> > 
> > On Tue, May 23, 2006 at 11:53:32AM -0500, John Newman wrote:
> > > I'm not familiar with this option, or even where this option would go...
> > > could you give me more info?  
> > > 
> > > thanks!
> > > 
> > > --
> > > John
> > > 
> > > On Tue, May 23, 2006 at 12:08:41PM -0400, Eric Lauzon wrote:
> > > > Do you use
> > > > the option:
> > > >  output-mode pktkludge 
> > > > ??
> > > > 
> > > > 
> > > > 
> > > > Eric Lauzon
> > > > [Recherche & D?veloppement]
> > > > Above S?curit? / Above Security
> > > > T?l  : (450) 430-8166
> > > > Fax : (450) 430-1858 
> > > > 
> > > > ---------------------------------------
> > > > "Premature optimization is the root of all
> > > > evil (or at least most of it) in programming."
> > > > - Donald Knuth
> > > >  
> > > > 
> > > > > -----Original Message-----
> > > > > From: snort-devel-admin at lists.sourceforge.net 
> > > > > [mailto:snort-devel-admin at lists.sourceforge.net] On Behalf Of 
> > > > > John Newman
> > > > > Sent: 23 mai 2006 12:06
> > > > > To: snort-users at lists.sourceforge.net; 
> > > > > snort-devel at lists.sourceforge.net
> > > > > Subject: [Snort-devel] portscan events not showing up in base
> > > > > 
> > > > > Hello,
> > > > > 
> > > > > I'm using snort 2.4.4 but not sfportscan, rather the older 
> > > > > portscan and
> > > > > portscan2 modules.  I've just realized that, although 
> > > > > portscans are being detected just fine, they aren't being 
> > > > > propagated through barnyard into the base database.  
> > > > > 
> > > > > e.g.
> > > > > 
> > > > > select * from acid_event where sig_name like '%portscan%' and 
> > > > > timestamp >
> > > > > '2006-05-01 00:00:00';
> > > > > 
> > > > > returns nothing
> > > > > 
> > > > > If I change the date portion to sometime last month, before I switched
> > > > > from sfportscan, I get all sorts of results.   Does anyone 
> > > > > have any clue
> > > > > what might be causing this?
> > > > > 
> > > > > thanks,
> > > > > 
> > > > > --
> > > > > John Newman
> > > > > Systems Administrator, WebXess Inc.
> > > > > 
> > > > > 
> > > > > -------------------------------------------------------
> > > > > Using Tomcat but need to do more? Need to support web 
> > > > > services, security?
> > > > > Get stuff done quickly with pre-integrated technology to make 
> > > > > your job easier
> > > > > Download IBM WebSphere Application Server v.1.0.1 based on 
> > > > > Apache Geronimo
> > > > > http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&
> > > > > dat=121642
> > > > > _______________________________________________
> > > > > Snort-devel mailing list
> > > > > Snort-devel at lists.sourceforge.net
> > > > > https://lists.sourceforge.net/lists/listinfo/snort-devel
> > > > >
> > > > 
> > > > AVERTISSEMENT CONCERNANT LA CONFIDENTIALIT? 
> > > > 
> > > > Le pr?sent message est ? l'usage exclusif du ou des destinataires mentionn?s ci-dessus. Son contenu est confidentiel et peut ?tre assujetti au secret professionnel. Si vous avez re?u le pr?sent message par erreur, veuillez nous en aviser imm?diatement et le d?truire en vous abstenant d'en faire une copie, d'en divulguer le contenu ou d'y donner suite.
> > > > 
> > > > CONFIDENTIALITY NOTICE
> > > > 
> > > > This communication is intended for the exclusive use of the addressee identified above. Its content is confidential and may contain privileged information. If you have received this communication by error, please notify the sender and delete the message without copying or disclosing it.
> > > > 
> > > > 
> > > > -------------------------------------------------------
> > > > Using Tomcat but need to do more? Need to support web services, security?
> > > > Get stuff done quickly with pre-integrated technology to make your job easier
> > > > Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> > > > http://sel.as-us.falkag.net/sel?cmd=lnk&kid0709&bid&3057&dat1642
> > > > _______________________________________________
> > > > Snort-devel mailing list
> > > > Snort-devel at lists.sourceforge.net
> > > > https://lists.sourceforge.net/lists/listinfo/snort-devel
> > > 
> > > -- 
> > > John Newman
> > > Systems Administrator, WebXess Inc.
> > > 
> > > 
> > > -------------------------------------------------------
> > > Using Tomcat but need to do more? Need to support web services, security?
> > > Get stuff done quickly with pre-integrated technology to make your job easier
> > > Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> > > http://sel.as-us.falkag.net/sel?cmd=lnk&kid0709&bid&3057&dat1642
> > > _______________________________________________
> > > Snort-devel mailing list
> > > Snort-devel at lists.sourceforge.net
> > > https://lists.sourceforge.net/lists/listinfo/snort-devel
> > 
> > -- 
> > John Newman
> > Systems Administrator, WebXess Inc.
> > 
> > 
> > -------------------------------------------------------
> > Using Tomcat but need to do more? Need to support web services, security?
> > Get stuff done quickly with pre-integrated technology to make your job easier
> > Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> > http://sel.as-us.falkag.net/sel?cmd=lnk&kid0709&bid&3057&dat1642
> > _______________________________________________
> > Snort-devel mailing list
> > Snort-devel at lists.sourceforge.net
> > https://lists.sourceforge.net/lists/listinfo/snort-devel
> 
> -- 
> John Newman
> Systems Administrator, WebXess Inc.
> 
> 
> -------------------------------------------------------
> All the advantages of Linux Managed Hosting--Without the Cost and Risk!
> Fully trained technicians. The highest number of Red Hat certifications in
> the hosting industry. Fanatical Support. Click to learn more
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid7521&bid$8729&dat1642
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

-- 
John Newman
Systems Administrator, WebXess Inc.




More information about the Snort-users mailing list