OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Distribution Lists (dist-lists_at_e-securenetworks.net)
Date: Mon Dec 02 2002 - 12:13:21 CST

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    I have this in my snort.conf

    preprocessor portscan2: scanners_max 3200, targets_max 5000, target_limit
    5, port_limit 20, timeout 60
    preprocessor portscan-ignorehosts: 24.167.76.32
    preprocessor portscan: $HOME_NET 4 3 portscan.log
    preprocessor portscan2-ignorehosts: 24.167.76.32

    but I still getting

    [**] [100:1:1] spp_portscan: PORTSCAN DETECTED from 24.167.76.32
    (THRESHOLD 4 connections exceeded in 0 seconds) [**]

    So any ideas what I have missed ?

    Regards

    -------------------------------------------------------
    This SF.net email is sponsored by: Get the new Palm Tungsten T
    handheld. Power & Color in a compact size!
    http://ads.sourceforge.net/cgi-bin/redirect.pl?palm0002en
    _______________________________________________
    Snort-users mailing list
    Snort-userslists.sourceforge.net
    Go to this URL to change user options or unsubscribe:
    https://lists.sourceforge.net/lists/listinfo/snort-users
    Snort-users list archive:
    http://www.geocrawler.com/redir-sf.php3?list=snort-users