Snort mailing list archives
portscan preprocessor and external net
From: marco turr <marco_syslnx () yahoo it>
Date: Tue, 29 Nov 2005 15:10:21 +0100 (CET)
Hi,
I have a problem with portscan preprocessor.
I need to detect scan from $home -> $home and scan from $home -> any.
I see that in sfportscan and flow-portscan preprocessor there are options like src-ignore-net or ignore-scanners.
Now if i set one of this options at $EXTERNAL_NET (where EXTERNAL_NET is !$HOME_NET) i get an error.
How can i resolve this?
Thanks a lot
---------------------------------
Yahoo! Mail: gratis 1GB per i messaggi, antispam, antivirus, POP3
Current thread:
- portscan preprocessor and external net marco turr (Nov 29)
- Re: portscan preprocessor and external net Jason Brvenik (Nov 29)
- Re: portscan preprocessor and external net marco turr (Nov 29)
- Re: portscan preprocessor and external net Matt Kettler (Nov 29)
- Re: portscan preprocessor and external net marco turr (Nov 29)
- Re: portscan preprocessor and external net marco turr (Nov 29)
- Re: portscan preprocessor and external net Jason Brvenik (Nov 29)
