sfportscan not detecting my scans

[Bassman Rod <rodbass63 () gmail com>]

Hi, I have Snort working and I see stuff in the logs while I have a simple
rule of detecting ICMP packets. But when I enabled sfportscan in the conf
file and made sure the rule is being fired up upon restart, it is not
detecting my port scans.

Scenario:
Snort is on 192.168.99.100

I fired a 'nmap -rR 192.168.99.100' command from a box on '192.168.1.XXX'
network. I looked in my portscan.logs and it's empty.

snort.conf:
ipvar HOME_NET 192.168.10.0/24
ipvar EXTERNAL_NET any

preprocessor sfportscan: proto  { all } memcap { 10000000 } sense_level {
medium } scan_type { all } logfile { /var/log/snort/portscan.log }

I have preprocessor.rules enabled.

Any help will be greatly appreciated.

------------------------------------------------------------------------------
Site24x7 APM Insight: Get Deep Visibility into Application Performance
APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
Monitor end-to-end web transactions and take corrective actions now
Troubleshoot faster and improve end-user experience. Signup Now!
http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!