This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

PSD not catching anything?

Orcusomega,

sure that you have enabled PSD and you didn't
exclude the external interface?

read you
o|iver

BTW currently we have tested it in detail and
I am pretty sure that it works as it supposed
to do!

[size="1"][ 30 December 2002, 14:17: Message edited by: oliver.desch ][/size]

This thread was automatically locked due to age.

Parents

0 Orcusomega over 22 years ago

Actually, I have nothing excluded, it is quite strange.

When I look at my portscan logs in Snort (in front of ASL 3.380) I see plenty of portscans, but none show up in PSD. What is the threshhold set to, and where can I set it?

Thanks,

Bob
Cancel
Vote Up 0 Vote Down

Cancel
0 oliver.desch over 22 years ago in reply to Orcusomega

Orcusomega,

login as root and have a look at "iptables -L -nv",
you'll find to tables PSD_MATCHER and PSD_ACTION.

You cannot manage it!

read you
o|iver
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 oliver.desch over 22 years ago in reply to Orcusomega

Orcusomega,

login as root and have a look at "iptables -L -nv",
you'll find to tables PSD_MATCHER and PSD_ACTION.

You cannot manage it!

read you
o|iver
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Orcusomega over 22 years ago in reply to oliver.desch

Will do.

I have since rebuilt my Snort system. Once I bring it back online, if the problem persists, I will give you the output of the portscan.log file, and the associated PSD logfile from ASL to perhaps help.

Bob
Cancel
Vote Up 0 Vote Down

Cancel
0 oliver.desch over 22 years ago in reply to Orcusomega

Orcusomega,

in my opinion there is no problem - just a different
way to interpret a portscan! (ASLYour Snort settings)

read you
o|iver
Cancel
Vote Up 0 Vote Down

Cancel