[ILUG] Detecting a port scan attempt on my machine.

[Paul Jakma]

On Wed, 7 Mar 2001, John P . Looney wrote:

>  Did you have a look at snort ?

aye, snort seems rather nice. i didn't at all like the way portsentry
binds to everything when i tried it yonks ago. snort though is very
nice cause it is so stealthy and passive.

be interested in what plop has to say about it in light of his very
well balanced and informative post to this same thread. (one to link
to from the linux.ie front page?)

also, i need to look at whether snort can read from a file or else
whether it can do full logging in IDS mode. Basically, i want to be
able to run snort *and* also have a log file of traffic for analysis
with tcpstat. But it would be very silly to have 2 processes sniffing
the same stuff.

So i need to either run one tcpdump logging to a file, and have snort
and tcpstat reading that file. Or else have snort do full tcpdump
style logging and have tcpstats read that file.

Unfortunately in IDS mode snort only logs packets that match a rule...

if anyone has the answer handy let me know.

> Kate

--paulj