sfportscan

[Bassman Rod <rodbass63 () gmail com>]

Resending with corrections.

Hi, I have Snort working and I see activity in the logs while I have a
simple rule of detecting ICMP packets. But when I enabled sfportscan in the
conf file and made sure the rule is being fired up upon restart, it is not
detecting my port scans.

Scenario:
Snort is on global non-private IP of: 44.44.44.44 (fictitious IP for the
sake of this email)

I fired  'nmap -rR 44.44.44.44' command several consecutive times from a
box on my business network '192.168.1.XXX' network. I looked in my
portscan.logs and it's empty.

snort.conf:
ipvar HOME_NET 192.168.10.0/24
ipvar EXTERNAL_NET any

preprocessor sfportscan: proto  { all } memcap { 10000000 } sense_level {
medium } scan_type { all } logfile { /var/log/snort/portscan.log }

I have preprocessor.rules enabled.

Any help will be greatly appreciated.

------------------------------------------------------------------------------
Site24x7 APM Insight: Get Deep Visibility into Application Performance
APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
Monitor end-to-end web transactions and take corrective actions now
Troubleshoot faster and improve end-user experience. Signup Now!
http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!