[Snort-sigs] portscan rule

Hi All,

I've been trying to put together a rule in the snort.conf file to 
address portscans.  For instance, if there is x amount of machines hit 
in y amount of minutes on port 445, snort will indicate that port 445 
is getting hit so many times.  This is a snippet of what I have so far:


------------------------snippet-------------------------------
##preporcessor portscan: $HOME_NET 5 7 /var/log/portscan.log
 
##preprocessor portscan-ignorehosts: x.x.x.x y.y.y.y etc.
 
preprocessor portscan: scanners_max 3200, targets_max 5000, 
target_limit 5, port_limit 20, timeout 60

------------------------/snippet--------------------------------
Is there anything I'm missing here?

Thanks.  forbin



-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs