OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Alberto Gonzalez (albertg_at_cerebro.violating.us)
Date: Mon Dec 02 2002 - 15:37:19 CST

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    Your alert came from spp_portscan, add the following to that line:
    preprocessor portscan-ignorehosts: 24.167.76.32/32

    Or the following for spp_portscan2
    preprocessor portscan2-ignorehosts: 34.167.76.32/32

    Why are you using both spp_portscan and spp_portscan2 ?

    Cheers!

        - Alberto

    Distribution Lists wrote:

    >I have this in my snort.conf
    >
    >preprocessor portscan2: scanners_max 3200, targets_max 5000, target_limit
    >5, port_limit 20, timeout 60
    >preprocessor portscan-ignorehosts: 24.167.76.32
    >preprocessor portscan: $HOME_NET 4 3 portscan.log
    >preprocessor portscan2-ignorehosts: 24.167.76.32
    >
    >but I still getting
    >
    >[**] [100:1:1] spp_portscan: PORTSCAN DETECTED from 24.167.76.32
    >(THRESHOLD 4 connections exceeded in 0 seconds) [**]
    >
    >So any ideas what I have missed ?
    >
    >Regards
    >
    >
    >
    >
    > 

    -- 
The secret to success is to start from scratch and keep on scratching.

    -------------------------------------------------------
This SF.net email is sponsored by: Get the new Palm Tungsten T 
handheld. Power & Color in a compact size! 
http://ads.sourceforge.net/cgi-bin/redirect.pl?palm0002en
_______________________________________________
Snort-users mailing list
Snort-userslists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users