Snort Working Mechanism

[Sonika Malhotra <sonikam () magnum barc ernet in>]

Hello List,
        I have a few doubts abt. the working of the snort.

1. I believe Stealth mode scan is a type of slow scan say 1 port/hr. how
does snort manage to find out such types of scans.
2. the logging facility of snort ie
         snort -dev -l /var/log/snort --doesn't see any rule file , so
 will this log 'ALL' the packets on the network completely.?
3. I have found that in NIDS mode ie
         snort -deD -l /var/log/snort -c /etc/snort.conf
         logs only part of complete data.ie maybe the current
packet.What if i want to log "everything " if attack is found.
i have gone thru the log-documents.plz clear these points.

Thanx
sm




_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users