Re: redundant rules

[Martin Roesch <roesch () sourcefire com>]

What are your HOME_NET and EXTERNAL_NET variables set to?  Are you
portscanning yourself from the same network that you're monitoring?

   -Marty

> "Watson, Ed" wrote:
>
> The default rules don't seem to pick up port scans, even obvious ones.
> I thought if I used the vision.rules, that would be more effective,
> and it hasn't. Could redundant rules cause it to not log these events?
>
> 1166 rules read...
> 1166 Option Chains linked into 257 Chain Headers
> 0 Dynamic rules
>
> System
>       Dell 1550
>         dual PIII 833
>         1gb ram
>         100baseTX FDX
>     Resource usage
>         Mem .6%
>         CPU  .1%
> OS
>     RH7
>
> Ed Watson

--
Martin Roesch
roesch () sourcefire com
http://www.sourcefire.com - http://www.snort.org

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users