Snort mailing list archives
Re: port scans
From: Jose Maria Lopez <jkerouac () bgsec com>
Date: 28 Dec 2004 23:43:15 +0100
El lun, 27 de 12 de 2004 a las 15:38, Sidharth Deshpande escribió:
Hello team, I am running snort on a test network. I was interested to know if snort can detect port scans that are extremely slow. Port scans that span over a few days for example. Is there a way for snort to identify this kind of scan?
I think it depends on the kind of scan. Snort can detect some kind of scans like the ones you can do with nmap even if it's just a single packet. But if someone it's portscanning you and taking days to do so they probably use UDP or TCP perfectly "legal" packets or connections, that snort probably won't see. The best way to log this kind of scans it's to have rules (you can use iptables or snort) that logs packets in ports that aren't running any server. That will give you the hint that someone it's portscanning you and not just trying to use your services.
I hope you could help me out with this information. Thanks Sidharth Deshpande ______________________________________________________________________ Do you Yahoo!? Take Yahoo! Mail with you! Get it on your mobile phone.
-- Jose Maria Lopez Hernandez Director Tecnico de bgSEC jkerouac () bgsec com bgSEC Seguridad y Consultoria de Sistemas Informaticos http://www.bgsec.com ESPAÑA The only people for me are the mad ones -- the ones who are mad to live, mad to talk, mad to be saved, desirous of everything at the same time, the ones who never yawn or say a commonplace thing, but burn, burn, burn like fabulous yellow Roman candles. -- Jack Kerouac, "On the Road" ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://productguide.itmanagersjournal.com/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- port scans Sidharth Deshpande (Dec 27)
- Re: port scans Michael Boman (Dec 27)
- Re: port scans Jose Maria Lopez (Dec 28)