[Snort-users] Snort-2.6.0.2 on FC6 fail to log Nmap TCP portscans.

Daniel saragon at ...5693...
Mon Oct 30 08:03:55 EST 2006


As the subject hints, I have some problems catching portscans with snort
on the latest fedora release. I've tried using snort-mysql and
snort-bloat from fedora-extras as well as compiling from source and none
of them log portscans for some reason.

I'm using the default config for snort. I've tried the default config
for sfportscan. I've tried changing the sfportscan sense_level to high.
I've tried adding scan_type { all }.

So, what am I missing here? Why won't it log Nmap portscans when I hit
it with 'nmap -sS/sT/sA/sN/sF snort-host' from a host on the same
network? If I scan the snort machine with nessus from the same host, it
catches the UDP port scan:

<snip>
10/30-09:14:49.310164  [**] [122:17:0] (portscan) UDP Portscan [**]
{PROTO255} 192.168.200.2 -> 192.168.200.160
</snip>

Any help would be greatly appreciated.

Best regards /d'.




More information about the Snort-users mailing list