Do you use
the option:
output-mode pktkludge
??
Eric Lauzon
[Recherche & Développement]
Above Sécurité / Above Security
Tél : (450) 430-8166
Fax : (450) 430-1858
---------------------------------------
"Premature optimization is the root of all
evil (or at least most of it) in programming."
- Donald Knuth
-----Original Message-----
From: snort-devel-admin@lists.sourceforge.net
[mailto:snort-devel-admin@lists.sourceforge.net] On Behalf Of
John Newman
Sent: 23 mai 2006 12:06
To: snort-users@lists.sourceforge.net;
snort-devel@lists.sourceforge.net
Subject: [Snort-devel] portscan events not showing up in base
Hello,
I'm using snort 2.4.4 but not sfportscan, rather the older
portscan and
portscan2 modules. I've just realized that, although
portscans are being detected just fine, they aren't being
propagated through barnyard into the base database.
e.g.
select * from acid_event where sig_name like '%portscan%' and
timestamp >
'2006-05-01 00:00:00';
returns nothing
If I change the date portion to sometime last month, before I switched
from sfportscan, I get all sorts of results. Does anyone
have any clue
what might be causing this?
thanks,
--
John Newman
Systems Administrator, WebXess Inc.
-------------------------------------------------------
Using Tomcat but need to do more? Need to support web
services, security?
Get stuff done quickly with pre-integrated technology to make
your job easier
Download IBM WebSphere Application Server v.1.0.1 based on
Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&;
dat=121642
_______________________________________________
Snort-devel mailing list
Snort-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-devel
AVERTISSEMENT CONCERNANT LA CONFIDENTIALITÉ
Le présent message est à l'usage exclusif du ou des destinataires mentionnés
ci-dessus. Son contenu est confidentiel et peut être assujetti au secret
professionnel. Si vous avez reçu le présent message par erreur, veuillez nous
en aviser immédiatement et le détruire en vous abstenant d'en faire une copie,
d'en divulguer le contenu ou d'y donner suite.
CONFIDENTIALITY NOTICE
This communication is intended for the exclusive use of the addressee
identified above. Its content is confidential and may contain privileged
information. If you have received this communication by error, please notify
the sender and delete the message without copying or disclosing it.
-------------------------------------------------------
All the advantages of Linux Managed Hosting--Without the Cost and Risk!
Fully trained technicians. The highest number of Red Hat certifications in
the hosting industry. Fanatical Support. Click to learn more
http://sel.as-us.falkag.net/sel?cmd_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list
