Always an option, but then again, that's what the portscan plugin is for.
Why reinvent the wheel? Better have the portscan plugin normalized to
produce consistent output.

-----Original Message-----
From: Frank Knobbe [mailto:fknobbeknobbeits.com]
Sent: Wednesday, November 27, 2002 7:34 PM
To: L. Christopher Luther
Cc: 'Erek Adams'; Snort-Users (E-mail)
Subject: RE: [Snort-users] Database Plugin - Alert vs. Log

On Wed, 2002-11-27 at 17:04, L. Christopher Luther wrote:
> When o when will the portscan data be normalized so that it can
> cleanly be put into a database?! Sigh...

Why don't you write some Snort rules that detect portscans? Create rules
that fire when unused IP's are accessed, and/or when used ports (on used
IP's) are accessed. That way you have the scan in a normal format in the
database.

Frank

-------------------------------------------------------
This SF.net email is sponsored by: Get the new Palm Tungsten T
handheld. Power & Color in a compact size!
http://ads.sourceforge.net/cgi-bin/redirect.pl?palm0002en
_______________________________________________
Snort-users mailing list
Snort-userslists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]