Re: Snort behind router

[Michael Lubinski <michael.lubinski () gmail com>]

How does the sfportscan preprocessor line in your snort.conf read?

On Sat, Mar 12, 2011 at 3:34 PM, <childrenofchaos () freenet de> wrote:

> Howdi all,
>
> Iam using Snort 2.9.0.4 behind a Router, which one handles the pppoe
> connect.
> Before i changed to the newest Version i run it with 2.8.6.x without any
> Problems,
> but now, i can´t see any Portscans from ext. hosts to the internal Network.
>
> snort is running and logs some p2p from an internal hosts, so snort is
> working.
>
> HOME_NET 192.168.17.0/24
> EXT_NET !$HOME_NET
>
> with tcpdump i can see the external ip, and the scans.
> whats wront?
>
> thanks!
>
>
>
>
>
> ---
> freenetMail - Der zuverlässige E-Mail-Dienst von freenet.de
> Jetzt http://mail.freenet.de/produkte/basic/index.html?pid=10111947018 mit
> 1 GB Speicher und Profi-Spamschutz sichern!
>
> ------------------------------------------------------------------------------
> Colocation vs. Managed Hosting
> A question and answer guide to determining the best fit
> for your organization - today and in the future.
> http://p.sf.net/sfu/internap-sfd2d
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------------------------------
Colocation vs. Managed Hosting
A question and answer guide to determining the best fit
for your organization - today and in the future.
http://p.sf.net/sfu/internap-sfd2d

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users