[Snort-users] Problems with snort
phil.e at ...15568...
Mon Mar 26 06:24:24 EDT 2012
> Hello everybody,
> I've recently setup snort 2.9.2 on Ubuntu, and used oinkmaster to get the 2921 rules.
> It runs fine in Daemon mode and the base interface is reporting alerts. The machine only currently has one NIC so i'm attempting to generate alerts from my laptop on the same network. I've tried ping flooding it and port scanning it but every alert is currently showing up as a "Community SIP TCP/IP message flooding directed to SIP proxy SID 100000160".
> Ive been led to believe that since i haven't tuned it yet these are false positives and will disappear when i have.
> My question is why are portscans and ping floods showing up as the same thing and why none of the three SID's detected so far appear in the online database?
More information about the Snort-users