[Snort-devel] New scan detection plugin

From: Rob Settle <settle(at)rjs3.com>
Date: Fri Jul 04 2003 - 09:12:12 EDT

Visit this website to read about a new scan plugin: http://rjs3.com/snortping

This plugin is geared toward Snort being used as an internet IDS. The idea that turned into SnortPing is based upon packets destined for down hosts.
In a perfect network, this would never occur. In real life, it occurs all the
time. Examples of this activity include misconfigured DNS settings, IP typos,
crashed servers, or scanning. SnortPing aims to discover those people scanning.
Visit for website for the details and code.

Rob

---

This SF.Net email sponsored by: Parasoft Error proof Web apps, automate testing & more. Download & eval WebKing and get a free book. www.parasoft.com/bulletproofapps

---

Snort-devel mailing list
Snort-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-devel Received on Tue Jul 8 16:45:44 2003