-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
BASE can't read < sfportscan. It never could. (its a bug inherited
from ACID)
Use sfportscan, it logs to db.
Joel
John Newman wrote:
Didn't seem to do the trick... anyone have any other ideas?
Also, I tried switching it from portscan2.log to portscan.log,
rebuilding my alert cache in base, a few other things... still can't get
portscans to show up.
thanks
--
John
On Tue, May 23, 2006 at 12:25:55PM -0500, John Newman wrote:
Could this be the answer to my problem:
base_conf.php has this setting, which I just set:
/* Snort spp_portscan log file */
$portscan_file = '/var/log/snort/portscan2.log';
Maybe this will do the trick!
On Tue, May 23, 2006 at 12:05:16PM -0500, John Newman wrote:
Oh, looks like this is for for flow-portscan, which I'm not using.
Maybe I should? How does it compare to sfportscan and portscan2 in
people's experience?
--
John
On Tue, May 23, 2006 at 11:53:32AM -0500, John Newman wrote:
I'm not familiar with this option, or even where this option would go...
could you give me more info?
thanks!
--
John
On Tue, May 23, 2006 at 12:08:41PM -0400, Eric Lauzon wrote:
Do you use
the option:
output-mode pktkludge
??
Eric Lauzon
[Recherche & D?veloppement]
Above S?curit? / Above Security
T?l : (450) 430-8166
Fax : (450) 430-1858
---------------------------------------
"Premature optimization is the root of all
evil (or at least most of it) in programming."
- Donald Knuth
-----Original Message-----
From: snort-devel-admin@lists.sourceforge.net
[mailto:snort-devel-admin@lists.sourceforge.net] On Behalf Of
John Newman
Sent: 23 mai 2006 12:06
To: snort-users@lists.sourceforge.net;
snort-devel@lists.sourceforge.net
Subject: [Snort-devel] portscan events not showing up in base
Hello,
I'm using snort 2.4.4 but not sfportscan, rather the older
portscan and
portscan2 modules. I've just realized that, although
portscans are being detected just fine, they aren't being
propagated through barnyard into the base database.
e.g.
select * from acid_event where sig_name like '%portscan%' and
timestamp >
'2006-05-01 00:00:00';
returns nothing
If I change the date portion to sometime last month, before I switched
from sfportscan, I get all sorts of results. Does anyone
have any clue
what might be causing this?
thanks,
--
John Newman
Systems Administrator, WebXess Inc.
-------------------------------------------------------
Using Tomcat but need to do more? Need to support web
services, security?
Get stuff done quickly with pre-integrated technology to make
your job easier
Download IBM WebSphere Application Server v.1.0.1 based on
Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&;
dat=121642
_______________________________________________
Snort-devel mailing list
Snort-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-devel
AVERTISSEMENT CONCERNANT LA CONFIDENTIALIT?
Le pr?sent message est ? l'usage exclusif du ou des destinataires
mentionn?s ci-dessus. Son contenu est confidentiel et peut ?tre assujetti
au secret professionnel. Si vous avez re?u le pr?sent message par erreur,
veuillez nous en aviser imm?diatement et le d?truire en vous abstenant
d'en faire une copie, d'en divulguer le contenu ou d'y donner suite.
CONFIDENTIALITY NOTICE
This communication is intended for the exclusive use of the addressee
identified above. Its content is confidential and may contain privileged
information. If you have received this communication by error, please
notify the sender and delete the message without copying or disclosing it.
-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job
easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid0709&bid&3057&dat1642
_______________________________________________
Snort-devel mailing list
Snort-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-devel
--
John Newman
Systems Administrator, WebXess Inc.
-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job
easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid0709&bid&3057&dat1642
_______________________________________________
Snort-devel mailing list
Snort-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-devel
--
John Newman
Systems Administrator, WebXess Inc.
-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job
easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid0709&bid&3057&dat1642
_______________________________________________
Snort-devel mailing list
Snort-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-devel
--
John Newman
Systems Administrator, WebXess Inc.
-------------------------------------------------------
All the advantages of Linux Managed Hosting--Without the Cost and Risk!
Fully trained technicians. The highest number of Red Hat certifications in
the hosting industry. Fanatical Support. Click to learn more
http://sel.as-us.falkag.net/sel?cmd=lnk&kid7521&bid$8729&dat1642
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFEc0wvKbCSyXHckt4RAjRfAJ9zy7LVO+ZuhK+QJa/h9bnsp4e01wCeLu8v
mU4WPRyhqVABn4PQtgg6dQk=
=8fp6
-----END PGP SIGNATURE-----
-------------------------------------------------------
All the advantages of Linux Managed Hosting--Without the Cost and Risk!
Fully trained technicians. The highest number of Red Hat certifications in
the hosting industry. Fanatical Support. Click to learn more
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=107521&bid=248729&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
