Snort mailing list archives
RE: snort + IPFilter?
From: Demetri Mouratis <dmourati () cm math uiuc edu>
Date: Tue, 4 Feb 2003 15:10:09 -0600 (CST)
On Tue, 4 Feb 2003, Everist, Benjamin S. (NASWI) wrote:
I found the scans, they are getting logged to /var/log/snort/scan.log, but not being seen by ACID. In snort.conf, preprocessor portscan is disabled, and preprocessors conversation and portscan2 are enabled. In acid.conf, $portscan_file is pointed to /var/log/snort/scan.log, which (currently) has its read bit set for everyone. I am NMAP connect scanning the machine snort is running on from a separate machine. Any idea why ACID isn't displaying info from scan.log? Thanks, Benjamin Everist
FAQ! http://www.snort.org/docs/faq.html#6.15 --------------------------------------------------------------------- Demetri Mouratis dmourati () linfactory com ------------------------------------------------------- This SF.NET email is sponsored by: SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See! http://www.vasoftware.com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- snort + IPFilter? Everist, Benjamin S. (NASWI) (Jan 31)
- <Possible follow-ups>
- RE: snort + IPFilter? Gonzalez, Albert (Jan 31)
- RE: snort + IPFilter? Everist, Benjamin S. (NASWI) (Feb 04)
- RE: snort + IPFilter? Demetri Mouratis (Feb 04)
- RE: snort + IPFilter? Everist, Benjamin S. (NASWI) (Feb 04)
- RE: snort + IPFilter? Everist, Benjamin S. (NASWI) (Feb 04)