I added these preprocessors using SnortCenter 0.9.6
But aren't the rule in the wrong order ?

preprocessor portscan2: scanners_max 3200, targets_max 5000, target_limit
5, port_limit 20, timeout 60
preprocessor portscan-ignorehosts: 24.167.76.32
preprocessor portscan: $HOME_NET 4 3 portscan.log
preprocessor portscan2-ignorehosts: 24.167.76.32

Shouldn't the 'portscan-ignorehosts' be after 'preprocessor portscan' ?

> Why are you using both spp_portscan and spp_portscan2 ?

I only just moved to 1.9.0, I was using 1.8.6 before, and had spp_portscan
configured. I wasn't sure which was the better, so I configured both :)

What is the better, spp_portscan or spp_portscan2 ?

Regards

> Your alert came from spp_portscan, add the following to that line:
> preprocessor portscan-ignorehosts: 24.167.76.32/32
>
> Or the following for spp_portscan2
> preprocessor portscan2-ignorehosts: 34.167.76.32/32
>
> Why are you using both spp_portscan and spp_portscan2 ?
>
> Cheers!
>
> - Alberto
>
> Distribution Lists wrote:
>
>>I have this in my snort.conf
>>
>>preprocessor portscan2: scanners_max 3200, targets_max 5000,
>> target_limit 5, port_limit 20, timeout 60
>>preprocessor portscan-ignorehosts: 24.167.76.32
>>preprocessor portscan: $HOME_NET 4 3 portscan.log
>>preprocessor portscan2-ignorehosts: 24.167.76.32
>>
>>but I still getting
>>
>>[**] [100:1:1] spp_portscan: PORTSCAN DETECTED from 24.167.76.32
>>(THRESHOLD 4 connections exceeded in 0 seconds) [**]
>>
>>So any ideas what I have missed ?
>>
>>Regards
>>
>>
>>
>>
>>
>
> --
> The secret to success is to start from scratch and keep on scratching.
>
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: Get the new Palm Tungsten T
> handheld. Power & Color in a compact size!
> http://ads.sourceforge.net/cgi-bin/redirect.pl?palm0002en
> _______________________________________________
> Snort-users mailing list
> Snort-userslists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

-------------------------------------------------------
This SF.net email is sponsored by: Get the new Palm Tungsten T
handheld. Power & Color in a compact size!
http://ads.sourceforge.net/cgi-bin/redirect.pl?palm0002en
_______________________________________________
Snort-users mailing list
Snort-userslists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]