[Snort-users] preprocessor sfportscan does not generate alerts

waldo kitty wkitty42 at ...14940...
Fri Feb 15 23:10:52 EST 2013


On 2/15/2013 17:04, Marc Belanger wrote:
> Hi,
>
> How do I troubleshoot a Snort install that generates no alert when the
> sfportscan preprocessor is activated?

do you have those specific rules enabled?

do your scans follow the specific portscan rules that snort has in the preprocessor?

i have seen some scans that do not trigger because there are no rules for 
them... or they don't comply with the existing rules...





More information about the Snort-users mailing list