Re: portscan2-ignorehosts & portscan-ignorehosts

["Distribution Lists" <dist-lists () e-securenetworks net>]

I added these preprocessors using SnortCenter 0.9.6
But aren't the rule in the wrong order ?

preprocessor portscan2: scanners_max 3200, targets_max 5000, target_limit
5, port_limit 20, timeout 60
preprocessor portscan-ignorehosts: 24.167.76.32
preprocessor portscan: $HOME_NET 4 3 portscan.log
preprocessor portscan2-ignorehosts:  24.167.76.32


Shouldn't the 'portscan-ignorehosts' be after 'preprocessor portscan' ?

> Why are you using both spp_portscan and spp_portscan2 ?

I only just moved to 1.9.0, I was using 1.8.6 before, and had spp_portscan
configured. I wasn't sure which was the better, so I configured both :)

What is the better, spp_portscan or spp_portscan2 ?

Regards

> Your alert came from spp_portscan, add the following to that line:
> preprocessor portscan-ignorehosts: 24.167.76.32/32
>
> Or the following for spp_portscan2
> preprocessor portscan2-ignorehosts: 34.167.76.32/32
>
> Why are you using both spp_portscan and spp_portscan2 ?
>
> Cheers!
>
>     - Alberto
>
> Distribution Lists wrote:
>
> > I have this in my snort.conf
> >
> > preprocessor portscan2: scanners_max 3200, targets_max 5000,
> > target_limit 5, port_limit 20, timeout 60
> > preprocessor portscan-ignorehosts: 24.167.76.32
> > preprocessor portscan: $HOME_NET 4 3 portscan.log
> > preprocessor portscan2-ignorehosts:  24.167.76.32
> >
> > but I still getting
> >
> > [**] [100:1:1] spp_portscan: PORTSCAN DETECTED from 24.167.76.32
> > (THRESHOLD 4 connections exceeded in 0 seconds) [**]
> >
> > So any ideas what I have missed ?
> >
> > Regards
>
> --
> The secret to success is to start from scratch and keep on scratching.
>
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: Get the new Palm Tungsten T
> handheld. Power & Color in a compact size!
> http://ads.sourceforge.net/cgi-bin/redirect.pl?palm0002en
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users





-------------------------------------------------------
This SF.net email is sponsored by: Get the new Palm Tungsten T 
handheld. Power & Color in a compact size! 
http://ads.sourceforge.net/cgi-bin/redirect.pl?palm0002en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users