[Snort-devel] New scan detection plugin

From: <snort(at)rjs3.com>
Date: Sat Jul 05 2003 - 09:49:59 EDT

Visit this website to read about a new scan plugin: http://rjs3.com/snortping

Overview:
This plugin is geared toward Snort being used as an internet IDS. The idea that turned into SnortPing is based upon packets destined for down hosts. In a perfect network, this would never occur. In real life, it occurs all the time. Examples of this activity include misconfigured DNS settings, IP typos, crashed servers, or scanning. SnortPing aims to discover those people scanning. Visit for website for the details and code.

Rob

---

This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100006ave/direct;at.asp_061203_01/01

---

Snort-devel mailing list
Snort-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-devel Received on Sat Jul 5 10:08:56 2003