Tcp portscans

["Lee Clemens" <snort () leeclemens net>]

Hello everyone,

I have been noticing a lot of alerts and logged packets with the title "TCP
Portscan", but when I look at Ethereal (running all the time) I can't seem
to find any packets similar to the ones logged. The full alert is

[122:1:0] (portscan) TCP Portscan {PROTO255} ExternalIP ->
IPofLocalDMZ.Computer

I have also seen a lot of packets logged with Info: Bogus IP length (14,
less than header length 20), but Ethereal does not see these on the regular
recording either.

Another interesting point is that the logged packets always have the same
Src and Dst MAC addresses (which isn't on my local network) but with a Src
IP address that I will see traffic from occasionally (legitamate), but not
with the DMZ.Computer. The Bogus IP length packets are logged as a response
to the "Portscan" but with no IP addresses (only the same MAC Src and Dst).

I'd really appreciate any help about this, I don't think it's anything from
my snort.conf file, but I am running:
preprocessor sfportscan: proto  { all } \
                         memcap { 10000000 } \
                         sense_level { low }

Thanks for any advice you can give me!

Lee Clemens
snort () leeclemens net

{
I'm running Snort 2.3
Windows XP Pro SP2
Ethereal 10.9
WinPcap 3.0alpha3
}




-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users