Re: portscan2-ignore... ???

[Michael D Schleif <mds () helices org>]

Michael D Schleif <mds () helices org> [2003:08:16:00:09:18-0500] scribed:
> I thought that I found a bug; but, it was silly me misunderstanding,
> again ;<
>
> I get alot of bunk like this:
>
>    9  192.168.123.150  216.52.3.11      (spp_portscan2) Portscan detected from 192.168.123.150: 6 targets 6 ports in 
> 13 seconds
>    8  192.168.123.150  216.52.3.4       (spp_portscan2) Portscan detected from 192.168.123.150: 6 targets 6 ports in 
> 17 seconds
>    8  192.168.123.150  216.52.3.4       (spp_portscan2) Portscan detected from 192.168.123.150: 6 targets 6 ports in 
> 11 seconds
>
> Well, wouldn't you know, 192.168.123.150 is my snort server, as well as
> serving numerous other tools.
>
> So, I want to _ignore_ scans that originate from 192.168.123.150 ; at
> which point I found this:
>
>    portscan2-ignoreports-from
>
> Clearly, I didn't read that label rigorously enough, nor did I find any
> documentation about it, and happily assumed -- erroneously -- that it
> was solution to my challenge ;>
>
> Of course, it (and its sister: portscan2-ignoreports-to) take only
> tcp/udp ports as arguments, and I am back to square one ;<
>
> Yes, I recognize this:
>
>    portscan2-ignorehosts
>
> However, doesn't that one ignore the host(s), both as source and
> destination?  What if I want to ignore spp_portscan2 *only* originating
> from 192.168.123.150?  Suppose that I am very interested in any scans
> where 192.168.123.150 is the destination/subject of that scan?

Now, I am more confused than ever; but, apparently, my challenge is
resolved?

   <http://marc.theaimsgroup.com/?l=snort-users&m=104799311508983&w=2>

This states:

   ``... that will ignore whatever hosts you put in that list.  Source,
     Destination, whatever.''

This is what I have in /etc/snort/snort.conf:

   preprocessor portscan-ignorehosts: 192.168.123.150 192.168.123.254
   preprocessor portscan2-ignorehosts: 192.168.123.150/32

To test, I use this from 192.168.123.110:

   nmap -O 192.168.123.150

and this from 192.168.123.150:

   nmap -O 192.168.123.110

*ALL* of this is logged in:

   /var/log/snort/portscan2.log

Interestingly enough, *only* the first test, _from_ 192.168.123.110,
gets logged in:

  /var/log/snort/alert

Thus, only when 192.168.123.150 is _destination_ for scans will it show
up in my reports?  Why does all of this get logged in
/var/log/snort/portscan2.log?

Considering the lack of documentation on this preprocessor, I am
belaboring this point, because I need to understand the intended
behaviour of portscan[2]?

What do you think?

-- 
Best Regards,

mds
-
Dare to fix things before they break . . .
-
Our capacity for understanding is inversely proportional to how much
we think we know.  The more I know, the more I know I don't know . . .
--

Attachment: _bin
Description: