Re: portscan2-ignoreports...anyone get it to work???

[Matt Kettler <mkettler () evi-inc com>]

I don't know, but if you ever hear of anyone that's ever been able to do 
anything useful with spp_portscan2, let me know..

After weeks of trying to make it do something useful, I gave up on 
portscan2 completely and disabled it in my configuration. The thing 
consumes a significant chunk of memory, falses like crazy as seeing an 
"syn-ack scan" whenever a client opens a webpage with lots of embedded 
images, and doesn't seem to honor ignores in a manner that fixes the 
"syn-ack scan".

I wound up installing spade instead. At least it behaves sanely, although 
it requires some tweaking to work to my liking and it listens to what I 
tell it to ignore....

I also have significantly lower memory usage, and significantly lower 
packet losses with that setup (I'm running on low-end hardware).


At 04:16 PM 3/20/2003 -0500, Jeff Oliveto wrote:
> Has anyone confirmed that the "preprocessor portscan2-ignoreports: s1 s2 
> d1 d2" variable works?
>
> I'm running snort v 1.9.1, and varified that the feature is in the 
> spp_portscan2.c source.
>
> No matter how I specify the variable in the snort.conf file I can't get 
> portscan2 to filter on the source or destination ports.  Tried several 
> different variations and none seem to have an affect (see examples 
> below).  BTW...the portscan2-ignorehosts variable does work in filtering 
> on the source address.
>
> If it does work...what is the trick?
>
> ======== examples ===============
>
> Preferred configuration:
>
> preprocessor portscan2-ignorehosts: $HOME_NET
> preprocessor portscan2-ignoreports: s53 s80 s443 d53 d80 d443
> preprocessor portscan2: scanners_max 3200, targets_max 5000, target_limit 
> 5, port_limit 20, timeout 60
>
> Alternate variations used during troubleshooting....
>
> Removed ignorehosts and filter just on source/destination port...doesn't work:
>
> #preprocessor portscan2-ignorehosts: $HOME_NET
> preprocessor portscan2-ignoreports: s53 s80 s443 d53 d80 d443
> preprocessor portscan2: scanners_max 3200, targets_max 5000, target_limit 
> 5, port_limit 20, timeout 60
>
> Reduce to one source port...doesn't work:
>
> preprocessor portscan2-ignorehosts: $HOME_NET
> preprocessor portscan2-ignoreports: s80
> preprocessor portscan2: scanners_max 3200, targets_max 5000, target_limit 
> 5, port_limit 20, timeout 60
>
> Change position...doesn't work:
>
> preprocessor portscan2-ignorehosts: $HOME_NET
> preprocessor portscan2: scanners_max 3200, targets_max 5000, target_limit 
> 5, port_limit 20, timeout 60
> preprocessor portscan2-ignoreports: s53 s80 s443 d53 d80 d443
> Jeff Oliveto



-------------------------------------------------------
This SF.net email is sponsored by: Tablet PC.  
Does your code think in ink? You could win a Tablet PC. 
Get a free Tablet PC hat just for playing. What are you waiting for? 
http://ads.sourceforge.net/cgi-bin/redirect.pl?micr5043en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users