[Snort-users] How many ports is considered a portsweep/portscan?

James Lay jlay at ...13475...
Thu Mar 18 09:10:11 EDT 2010


Subject pretty much says it all...there are certain machines that I want to
be able to detect a portsweep or scan, but not when they scan say 4 or 5
ports like booting up with netbios checking out other machines on a network
(I think that¹s why I¹m seeing these FP¹s).  Sfportscan is set to low, but
I¹m not sure what else I can set?  Thanks all.

James
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20100318/e51f92c4/attachment.html>


More information about the Snort-users mailing list