Re: sfportscan logging

John,

Can you provide me with more details about the inconsistencies that you see?

We are aware that sfportscan has some inconsistencies in its output (and 
that the output is often
confusing), and will address those as soon as we can, in our schedule.  
Still, detecting portscans is
not an exact science, and it's possible for sfportscan to get confused.  
I definitely would not recommend
going backto any earlier portscan--in fact they've all been deprecated.  
Try to continue tuning and see if you
can get better results.

Thanks for the report.

-Andy


John Newman wrote:
> Hello,
>
> Despite the fact that snort basically kicks ass I'm having some problems.
>
> I've got sfportscan enabled in 2.4.4. It works well, but generates lots of
> false positives on our (busy) network. The widely touted README.sfportscan
> has a guide to tuning, including using specific pieces of output from the
> log file e.g. connection and priority counts, ip count, etc., to determine
> false positives.
>
> The problem is, AFAICT, the connection count and most of the other data
> put in that logfile (the one you specifiy in the sfportscan preprocessor
> line in snort.conf) is mostly inaccurate, at least on my box. Connection
> and priority counts never add up to the number of ports being scanned in
> tests I run. Sometimes a portscan I generate from a single host is detected
> as a distributed portscan and the log file actually shows me the other IPs
> that are supposed to have participated.
>
> This is on a basically stock Fedora Core 3 box, with snort built from
> scratch. Any ideas? Or should I just go back to using the originsl portscan
> modules? (We use the output from this stuff to generate iptables rules to
> block people that portscan us, amongst other things).
>
> thanks,
>
>   



-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642