spp_portscan and ACID

[Alwin Raymundo <alrayworld () yahoo com>]

Hi Guys,

Jason yates wrote on april 01,2002 regarding
spp_portscan and Acid.

Does answer this question?, because I experience the
same thing.

Any help is highly appreciated.



Orignal messages:
In ACID, I get warned of portscan scan events like
this.

     spp_portscan: End of portscan from 10.165.21.21:
TOTAL time(14s)
     hosts(41) TCP(1) UDP(43)

     For some reason, when I click to see the event I
can't see whom
     10.165.21.21 is scanning.  If I check the
portscan.log file.  I have
     logs like this

     Apr  1 14:38:58 10.165.21.21:1052 ->
10.217.5.32:38293 UDP  
     Apr  1 14:38:58 10.165.21.21:1052 ->
10.217.5.76:38293 UDP

     How can I get those events to show up in ACID?


     -Jason Yates



=====
Alwin Raymundo

__________________________________________________
Do You Yahoo!?
Yahoo! Tax Center - online filing with TurboTax
http://taxes.yahoo.com/

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users