Snort log help!

[Peter Rodger <prodger2008 () yahoo com>]

Hi all,

Today, I put snort behind PIX (port spanning from PIX
port to snort monitoring port) as follows:

#19-(1-15529) [snort] (portscan) TCP Portscan
2005-10-06 16:26:40 x.x.x.x 10.1.15.30 Raw IP  
(x.x.x.x is externel IP)

Does this mean x.x.x.x scan this IP?  or just false
positive?

I'll appreciate your help.

Peter


                
__________________________________ 
Yahoo! Mail - PC Magazine Editors' Choice 2005 
http://mail.yahoo.com


-------------------------------------------------------
This SF.Net email is sponsored by:
Power Architecture Resource Center: Free content, downloads, discussions,
and more. http://solutions.newsforge.com/ibmarch.tmpl
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users