Snort mailing list archives
RE: snort + IPFilter?
From: "Everist, Benjamin S. (NASWI)" <EveristB () naswi navy mil>
Date: Tue, 4 Feb 2003 13:59:01 -0800
You mean I have to READ? (thanks, that did it) -----Original Message----- From: Demetri Mouratis [mailto:dmourati () cm math uiuc edu] Sent: Tuesday, February 04, 2003 01:10 PM To: Everist, Benjamin S. (NASWI) Cc: Snort-users () lists sourceforge net Subject: RE: [Snort-users] snort + IPFilter? On Tue, 4 Feb 2003, Everist, Benjamin S. (NASWI) wrote:
I found the scans, they are getting logged to /var/log/snort/scan.log, but not being seen by ACID. In snort.conf, preprocessor portscan is disabled, and preprocessors conversation and portscan2 are enabled. In acid.conf, $portscan_file is pointed to /var/log/snort/scan.log, which (currently) has its read bit set for everyone. I am NMAP connect scanning the machine snort is running on from a separate machine. Any idea why ACID isn't displaying info from scan.log? Thanks, Benjamin Everist
FAQ! http://www.snort.org/docs/faq.html#6.15 --------------------------------------------------------------------- Demetri Mouratis dmourati () linfactory com
Current thread:
- snort + IPFilter? Everist, Benjamin S. (NASWI) (Jan 31)
- <Possible follow-ups>
- RE: snort + IPFilter? Gonzalez, Albert (Jan 31)
- RE: snort + IPFilter? Everist, Benjamin S. (NASWI) (Feb 04)
- RE: snort + IPFilter? Demetri Mouratis (Feb 04)
- RE: snort + IPFilter? Everist, Benjamin S. (NASWI) (Feb 04)
- RE: snort + IPFilter? Everist, Benjamin S. (NASWI) (Feb 04)