[Snort-users] Portscan Logs
jpolsky at ...14758...
Tue Apr 26 11:07:07 EDT 2011
I know I posted a question about portscan logs earlier, but I had a different question in regards to the current log that we are now using. For the portscan log:
x.x.x.x -> x.x.x.x(portscan) UDP Filtered Portscan
Priority Count: 0
Connection Count: 200
IP Count: 66
Scanner IP Range:x.x.x.x:x.x.x.x
Port/Proto Count: 32
Port/Proto Range: 137:17500
I am trying to determine the source port and destination port. Also wanted to clarify for this line: x.x.x.x -> x.x.x.x(portscan) UDP Filtered Portscan
That the first ip is the source and last is the destination. We are needing those 4 pieces of information from this log. Also is there anyway to obtain the flags from this portscan. Thanks again for any help you can give.
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-users