Snort mailing list archives
Re: ACID + spp_portscan
From: roman () danyliw com
Date: Thu, 24 May 2001 14:30:26 US/Eastern
There are many ways to answer your question, but they all come down do the fact that there is no way current to do this. - In the extremely near future, ACID could merely ignore "spp_portscans" in the unique alerts page, and create another page which merely lists these messages? Any interest? - When ACID implements classification and priorities, spp_portscans could be "faked" into being "probes". Thus, the "unique alerts" page can be viewed from the perspective of alert class - Snort internals need to be changed so that pre-processor alerts communitcate in a well-formed manner with output plugins. This will eliminate 1-signature per every portscan. Roman
Hi all, any idea how I can avoid having lots of different "signatures" generated by spp_portscan in my database? At the moment they are making the "unique signatures" page a little unreadable. cheers Tom _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: http://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
--------------------------------------------- This message was sent using Voicenet WebMail. http://www.voicenet.com/webmail/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: http://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- ACID + spp_portscan Thomas Whipp (May 24)
- <Possible follow-ups>
- Re: ACID + spp_portscan roman (May 24)
- Re: ACID + spp_portscan dmuz (May 24)