Snort mailing list archives
Re: portscan2-ignore... ???
From: Michael D Schleif <mds () helices org>
Date: Mon, 18 Aug 2003 21:14:02 -0500
Erek Adams <erek () snort org> [2003:08:18:20:20:29-0400] scribed:
On Sun, 17 Aug 2003, Michael D Schleif wrote: [...snip...]snort <options> 'not src host 192.168.123.150'[...snip...]That is *not* what I want to do ;>Actually it is. :)
I'm not ready -- yet -- to ignore *everything* originating on 192.168.123.150 ;>
As I explained in the original post: ``What if I want to ignore spp_portscan2 *only* originating from 192.168.123.150? Suppose that I am very interested in any scans where 192.168.123.150 is the destination/subject of that scan?''Look at the top line. It says "not src" which mean show all traffic except that which has a SOURCE IP ip of 192.168.123.150.Now, I have un-configured portscan[1], and have retested: [1] From 192.168.123.110: nmap -O 192.168.123.150 -- which spews into /var/log/snort/portscan2.log, and gives me spp_portscan2 in /var/log/snort/alert . [2] From 192.168.123.150: nmap -O 192.168.123.110 -- which puts _nothing_ in /var/log/snort/portscan2.log, and _no_ spp_portscan2 in /var/log/snort/alert .Yes. Both normal, and working the way you want.[3] From 192.168.123.150: nmap -O localhost -- which puts _nothing_ in /var/log/snort/portscan2.log, and _no_ spp_portscan2 in /var/log/snort/alert .Normal. Localhost is 127.0.0.1 not 192.168.123.150.So, I guess my confusion was whether or not *ALL* scans of 192.168.123.150, originating somewhere other than 192.168.123.150, would result in spp_portscan2 alerts? Apparently, as I desire, that is the case. Have I missed anything? If not, case closed and thank you for clarification . . .I think that should get you going.
Yes, I am now clear what snort is doing in this scenario. Although, I may have issues with the debian-specific package and its reporting mechanism, those I will take up with debian. Thank you, for your consideration and follow through . . . -- Best Regards, mds - Dare to fix things before they break . . . - Our capacity for understanding is inversely proportional to how much we think we know. The more I know, the more I know I don't know . . . --
Attachment:
_bin
Description:
Current thread:
- portscan2-ignore... ??? Michael D Schleif (Aug 15)
- Re: portscan2-ignore... ??? Michael D Schleif (Aug 16)
- Re: portscan2-ignore... ??? Erek Adams (Aug 17)
- Re: portscan2-ignore... ??? Michael D Schleif (Aug 17)
- Re: portscan2-ignore... ??? Michael D Schleif (Aug 18)
- Re: portscan2-ignore... ??? Erek Adams (Aug 18)
- Re: portscan2-ignore... ??? Michael D Schleif (Aug 18)
- Re: portscan2-ignore... ??? Erek Adams (Aug 19)
- Re: portscan2-ignore... ??? Erek Adams (Aug 17)
- Re: portscan2-ignore... ??? Michael D Schleif (Aug 16)
- Re: portscan2-ignore... ??? Erek Adams (Aug 18)
- Re: portscan2-ignore... ??? Michael D Schleif (Aug 18)