conversation/portscan oddity

["Kreimendahl, Chad J" <Chad.Kreimendahl () umb com>]

If conversation is set to only allow protocol 1 (or 6 or 17), would
portscan2 be allowed to generate portscan alerts for the protocols not
allowed?

I tested this theory today with allowed protocols 6 17 and was still
able to get portscan2 to kick off alerts when doing pingscans (1 -
ICMP).  Is conversation broken? Does portscan2 even use conversation? 


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users