Rules for non existent IPs

[Marc Cozzi <cozzi () nd edu>]

Is there any way to define a rule that will fire when an outside
source tries to access a non existent inside IP number?  Something
like the following does not seem to work. By access I mean
running nmap, scanners, pings etc..

alert tcp any any -> X.X.X.1 any (msg:"TCP port scan" ) 
alert ucp any any -> X.X.X.1 any (msg:"UCP port scan") 
alert icmp any any -> X.X.X.1 any (msg:"ICMP scan") 

Thanks
  --marc


-------------------------------------------------------
This SF.net email is sponsored by: The Robotic Monkeys at ThinkGeek
For a limited time only, get FREE Ground shipping on all orders of $35
or more. Hurry up and shop folks, this offer expires April 30th!
http://www.thinkgeek.com/freeshipping/?cpg=12297
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users