Denmarc/Snort and portscans

["Lists" <lists () paladinss com>]

Greetings,

I am lighting off a portscan on my home_net and nothing is popping up on
Demarc or getting logged to /var/log/snort/portscan.log

The machine I am launching the scan from is on my home_net subnet.  I
notice in the snort.conf portscan preprocessor:

preprocessor portscan: $HOME_NET 4 3 portscan.log

I have tried changing the value to: "any" (no quotes) with no luck.

Anybody have any thoughts?

TIA

Ben
 



_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users