Re: snort- problems

From: Alfredo Octavio <aov(at)primeordeal.com>
Date: Wed Aug 06 2003 - 13:59:44 EDT

There is an obvious false positive, it is when a user or a program issues an id command, if you are using Mac OS X and do not have root activated (which you shouldn't), then you can safely ignored this alerts.
About your other problem I am not sure. Normal snort configuration should be scanning your whole subnet. There must be something in the network config (a blocked switch?) not permitting it... Ciao,
aov

On Wednesday, August 6, 2003, at 10:52 AM, Rishi Pande wrote:

> 2) Last night I had a bunch of alerts pop-up which said

---

You probably wouldn't worry about what people think of you if you could know how seldom they do.

• Olin Miller

  ---

  Alfredo Octavio PGP Key ID: 0x6531FC6D mailto: alfredo@octavio.net http://alfredo.octavio.net/ At: N 10¢ª29.809', W 066¢ª49.480'

  ---

  ---

Captus Networks - Integrated Intrusion Prevention and Traffic Shaping

• Instantly Stop DoS/DDoS Attacks, Worms & Port Scans
• Automatically Control P2P, IM and Spam Traffic
• Ensure Reliable Performance of Mission Critical Applications Precisely Define and Implement Network Security and Performance Policies **FREE Vulnerability Assessment Toolkit - WhitePapers - Live Demo Visit us at: http://www.captusnetworks.com/ads/31.htm

  ---

Received on Wed Aug 6 15:30:34 2003