spp_portscan and ACID

[Jason Yates <jyates () dataservice org>]

In ACID, I get warned of portscan scan events like this.

spp_portscan: End of portscan from 10.165.21.21: TOTAL time(14s)
hosts(41) TCP(1) UDP(43)

For some reason, when I click to see the event I can't see whom
10.165.21.21 is scanning.  If I check the portscan.log file.  I have
logs like this

Apr  1 14:38:58 10.165.21.21:1052 -> 10.217.5.32:38293 UDP  
Apr  1 14:38:58 10.165.21.21:1052 -> 10.217.5.76:38293 UDP

How can I get those events to show up in ACID?


-Jason Yates


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users