RE: Portscan log

[francisv () dagupan com]

I have this:

        preprocessor portscan: $HOME_NET 5 5 portscan.log

and I do have portscan.log in /var/log/snort but why am I not seeing it
reported by ACID?

-----Original Message-----
From: John Sage [mailto:jsage () finchhaven com] 
Sent: Friday, September 13, 2002 8:58 PM
To: francisv () dagupan com
Cc: snort-users () lists sourceforge net
Subject: Re: [Snort-users] Portscan log

On Fri, Sep 13, 2002 at 10:55:04AM +0800, francisv () dagupan com wrote:
> Hi,
>
> How do I log portscans in the SQL database?
>
> ---
>  francis a. vidal [bitstop network services] | http://www.bitstop.ph
>  streaming media + web hosting               | http://www.keystone.ph
>  v(02)330-2871,(02)330-2872; f(02)330-2873   | http://www.kuro.ph 

umm..

Are they *not* being logged?

Are you saying this:

<snip>
# portscan: detect a variety of portscans
# ---------------------------------------
# portscan preprocessor by Patrick Mullen <p_mullen () linuxrc net>
# This preprocessor detects UDP packets or TCP SYN packets going to
# four different ports in less than three seconds. "Stealth" TCP
# packets are always detected, regardless of these settings. 

preprocessor portscan: $HOME_NET 4 3 portscan.log
# keep as from 1.8.4
<snip>

In your snort.conf?


For me, this creates a text log in my snort logging directory, and an
alert goes into the database, as well...

...I'm not aware that you need to do more.


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users