Snort mailing list archives
RE: TCP Portsweep and TCP Portscan
From: "Alex Butcher, ISC/ISYS" <Alex.Butcher () bristol ac uk>
Date: Fri, 28 Jan 2005 13:53:28 +0000
--On 16 December 2004 08:34 -0800 Bob Konigsberg <bobkberg () networkeval com> wrote:
TCP Portsweep is probably a reference to the nmap security scanner or similar tool. If I were in your position, I'd track down the owner/user of the machine in question and find out what he or she is doing and why. A conversation like that is bound to be illuminating on many fronts.
I've also observed P2P traffic set off those alerts (not surprising, given the similar patterns).
The Snort manual explains exactly what the sfportscan preprocessor is looking for.
Bob
Best Regards, Alex. -- Alex Butcher: Security & Integrity, Personal Computer Systems Group Information Systems and Computing GPG Key ID: F9B27DC9 GPG Fingerprint: D62A DD83 A0B8 D174 49C4 2849 832D 6C72 F9B2 7DC9 ------------------------------------------------------- This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting Tool for open source databases. Create drag-&-drop reports. Save time by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc. Download a FREE copy at http://www.intelliview.com/go/osdn_nl _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- RE: TCP Portsweep and TCP Portscan Alex Butcher, ISC/ISYS (Jan 28)