Re: Snort & portscans in a proxied environment

["Jacob Redding" <Jacob () wiredgeek com>]

  I have the same situation.. My solution..
disable portscan2 ;)

  If someone has a better solution, I'm all ears too..

-jacob

> I'm looking for ideas on how to keep snort's portscan2 preprocessor
> from triggering on responses to my proxy server.  Over half of the
> portscans I get are things like:
>
> src: some.web.server.outthere dst: my.pos.proxy.server sport: 80 dport:
> some_ephemeral_port
>
> It's obvious to me that these requests are responses to requests my
> proxy made on behalf of its clients.  Adding my.po.proxy.server to
> portscan2-ignorehosts obviously doesn't do much good, since it's not
> the source, after all.  The only thing I can think of is a daily purge
> of this sort of data from my portscan.log file.
>
> I can't be the only one in the world seeing this... anyone have any
> solutions that can help me out?  Anything would be appreciated.
>
> Cheers,
> Mike
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by:
> Battle your brains against the best in the Thawte Crypto
> Challenge. Be the first to crack the code - register now:
> http://www.gothawte.com/rd521.html
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users





-------------------------------------------------------
This sf.net email is sponsored by: 
Battle your brains against the best in the Thawte Crypto 
Challenge. Be the first to crack the code - register now: 
http://www.gothawte.com/rd521.html
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users