snort-users April 2011 archive
Main Archive Page > Month Archives  > snort-users archives
snort-users: [Snort-users] Portscan Logs

[Snort-users] Portscan Logs

From: Joshua Polsky <jpolsky_at_nospam>
Date: Tue Apr 26 2011 - 15:07:07 GMT
To: "snort-users@lists.sourceforge.net" <snort-users@lists.sourceforge.net>

I know I posted a question about portscan logs earlier, but I had a different question in regards to the current log that we are now using. For the portscan log:

Time: 04/13-15:29:41.660134
event_id: 6042
x.x.x.x -> x.x.x.x(portscan) UDP Filtered Portscan
Priority Count: 0
Connection Count: 200
IP Count: 66
Scanner IP Range:x.x.x.x:x.x.x.x
Port/Proto Count: 32
Port/Proto Range: 137:17500

I am trying to determine the source port and destination port. Also wanted to clarify for this line: x.x.x.x -> x.x.x.x(portscan) UDP Filtered Portscan
That the first ip is the source and last is the destination. We are needing those 4 pieces of information from this log. Also is there anyway to obtain the flags from this portscan. Thanks again for any help you can give.

------------------------------------------------------------------------------
WhatsUp Gold - Download Free Network Management Software
The most intuitive, comprehensive, and cost-effective network
management toolset available today. Delivers lowest initial
acquisition cost and overall TCO of any competing solution.
http://p.sf.net/sfu/whatsupgold-sd

_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users