OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Robby Desmond (rdesmond_at_els.ucsb.edu)
Date: Mon Dec 02 2002 - 13:22:06 CST

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    At 01:37 PM 12/2/2002 -0800, Alberto Gonzalez wrote:
    >Your alert came from spp_portscan, add the following to that line:
    >preprocessor portscan-ignorehosts: 24.167.76.32/32

    Umm, the actual problem is that his portscan-ignorehosts needs to be
    *after* his initial portscan line.

    >Or the following for spp_portscan2
    >preprocessor portscan2-ignorehosts: 34.167.76.32/32
    >
    >Why are you using both spp_portscan and spp_portscan2 ?

    Yeah. That is a good question. Why?

    >Cheers!
    >
    > - Alberto
    >
    >Distribution Lists wrote:
    >
    >>I have this in my snort.conf
    >>
    >>preprocessor portscan2: scanners_max 3200, targets_max 5000, target_limit
    >>5, port_limit 20, timeout 60
    >>preprocessor portscan-ignorehosts: 24.167.76.32
    >>preprocessor portscan: $HOME_NET 4 3 portscan.log
    >>preprocessor portscan2-ignorehosts: 24.167.76.32
    >>
    >>but I still getting
    >>
    >>[**] [100:1:1] spp_portscan: PORTSCAN DETECTED from 24.167.76.32
    >>(THRESHOLD 4 connections exceeded in 0 seconds) [**]
    >>
    >>So any ideas what I have missed ?
    >>
    >>Regards
    >>
    >>
    >>
    >>
    >
    >--
    >The secret to success is to start from scratch and keep on scratching.
    >
    >
    >
    >
    >-------------------------------------------------------
    >This SF.net email is sponsored by: Get the new Palm Tungsten T handheld.
    >Power & Color in a compact size!
    >http://ads.sourceforge.net/cgi-bin/redirect.pl?palm0002en
    >_______________________________________________
    >Snort-users mailing list
    >Snort-userslists.sourceforge.net
    >Go to this URL to change user options or unsubscribe:
    >https://lists.sourceforge.net/lists/listinfo/snort-users
    >Snort-users list archive:
    >http://www.geocrawler.com/redir-sf.php3?list=snort-users

    Robert Desmond
    Systems Administrator
    UCSB Extended Learning Services
    805-893-4906

    -------------------------------------------------------
    This SF.net email is sponsored by: Get the new Palm Tungsten T
    handheld. Power & Color in a compact size!
    http://ads.sourceforge.net/cgi-bin/redirect.pl?palm0002en
    _______________________________________________
    Snort-users mailing list
    Snort-userslists.sourceforge.net
    Go to this URL to change user options or unsubscribe:
    https://lists.sourceforge.net/lists/listinfo/snort-users
    Snort-users list archive:
    http://www.geocrawler.com/redir-sf.php3?list=snort-users