[Snort-users] sfPortscan - false positive

Izik Birka Izik.Birka at ...17456...
Sun Feb 21 10:14:58 EST 2016


Yes I know , but still it's not enough , I still getting a lot of false positive ,
This is the only options I have ?

Thanks
izik

From: Y M [mailto:snort at ...15979...]
Sent: Sunday, February 21, 2016 4:33 PM
To: Izik Birka <Izik.Birka at ...17456...>
Cc: snort-users at lists.sourceforge.net
Subject: RE: [Snort-users] sfPortscan - false positive

If you review the sfportscan configurations here: http://manual.snort.org/node79.html, you can specify the scan type and the scan sensitivity, watch, and ignore. Portsweep is different than port scan, is just an example.

YM

Sent from Mobile



On Sun, Feb 21, 2016 at 6:28 AM -0800, "Izik Birka" <Izik.Birka at ...17456...<mailto:Izik.Birka at ...17456...>> wrote:
How this data can help me ? if I can't change the ratio
I continue to get false positive alerts

Is there any way to configure the number of scanning attempt and the time period for alert to show ?

In the past the command was bit different and I was able to configure it

Example :
Preprocessor portscan: 192.168.1.0/24 10 60
10 is the number of scanning attempt
60 is time period

Thanks
Izik Birka



From: Y M [mailto:snort at ...15979...]
Sent: Sunday, February 21, 2016 4:20 PM
To: Izik Birka <Izik.Birka at ...17456...<mailto:Izik.Birka at ...17456...>>
Cc: snort-users at lists.sourceforge.net<mailto:snort-users at ...3783...net>
Subject: Re: [Snort-users] sfPortscan - false positive

I believe they refer to the data generated by the preprocessor. Review the distribution of the data points mentioned. I am not on a computer to verify.

YM

Sent from Mobile


On Sun, Feb 21, 2016 at 3:20 AM -0800, "Izik Birka" <Izik.Birka at ...17456...<mailto:Izik.Birka at ...17456...>> wrote:
Hi
I'm trying to tune PortScan false Positive I found this explanation in snort site

Make use of the Priority Count, Connection Count, IP Count, Port Count, IP range, and Port range to determine false positives.

But I didn't understand where I can change those values ,

Who knows ?

Thanks
Izik Birka

This message (including any attachments) is intended only for the use of the individual or entity to which it is addressed and may contain materials protected by copyright or information that is non-public, proprietary, privileged, confidential, and exempt from disclosure under applicable law or agreement. If you are not the intended recipient, you are hereby notified that any use, dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication by error, notify the sender immediately and delete this message immediately. Thank you.

This message (including any attachments) is intended only for the use of the individual or entity to which it is addressed and may contain materials protected by copyright or information that is non-public, proprietary, privileged, confidential, and exempt from disclosure under applicable law or agreement. If you are not the intended recipient, you are hereby notified that any use, dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication by error, notify the sender immediately and delete this message immediately. Thank you.

This message (including any attachments) is intended only for the use of the individual or entity to which it is addressed and may contain materials protected by copyright or information that is non-public, proprietary, privileged, confidential, and exempt from disclosure under applicable law or agreement.

If you are not the intended recipient, you are hereby notified that any use, dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication by error, notify the sender immediately and delete this message immediately.

Thank you.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20160221/26b20902/attachment.html>


More information about the Snort-users mailing list