[Snort-users] Portscan Logs

Joshua Polsky jpolsky at ...14758...
Tue Apr 26 11:07:07 EDT 2011


I know I posted a question about portscan logs earlier, but I had a different question in regards to the current log that we are now using.  For the portscan log:

Time: 04/13-15:29:41.660134
event_id: 6042
x.x.x.x -> x.x.x.x(portscan) UDP Filtered Portscan
Priority Count: 0
Connection Count: 200
IP Count: 66
Scanner IP Range:x.x.x.x:x.x.x.x
Port/Proto Count: 32
Port/Proto Range: 137:17500

I am trying to determine the source port and destination port.    Also wanted to clarify for this line:  x.x.x.x -> x.x.x.x(portscan) UDP Filtered Portscan
That the first ip is the source and last is the destination.   We are needing those 4 pieces of information from this log.     Also is there anyway to obtain the flags from this portscan.     Thanks again for any help you can give.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20110426/2dafedda/attachment.html>


More information about the Snort-users mailing list