Hello,
I'm currently running snort 2.4.4 with the portscan and portscan2
preprocessors that I have hooked into a script that generates
iptables rules. It works very well for what it is.
I recently have been playing with snort 2.8, trying to get at least
the same level of detection, with at least as few or fewer false
positives. I notice that flow-portscan seems to work well at
detecting some things portscan and portscan2 did not - like ICMP
probes across my entire /22. It also picks up nmap scans and things
like that. However, I've also noticed that it often seems to
confuse source and destination, or at least it seems to be confusing
them. What I mean to say is, if I have a process running on a
machine in my src-ignore-net that opens a bunch of connections and
thus has a bunch of high ports for its receiving end flow-portscan
will alert on the destination host that is connecting to those
ephemeral ports on my originating machine, even though the IP address
of the originating host is in my src-ignore-net.
Does anyone have any recommendations? I figured flow/flow-portscan
would determine source and destination based on who had the SYN flag
set. Because I'm not even talking about weird protocols like ftp
that open their own receiving ports on the initiating host, I'm just
talking about busy network programs, like a recursive wget, or
something similar.
I haven't played much with sfportscan. I had bad experiences
attempting to use it when I upgraded from 1.9 to 2.4.4.
thanks,
--
cachehit@webii.net
“The sky above the port was the color of television, tuned to a dead
station.”
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
