Can snort output an alert for a portscan (sfPortscan) to syslog?
- by Jamie McNaught
I've been working on this for too long now. I'm sure the answer should be obvious, but...
Snort manual:
http://www.snort.org/assets/125/snort_manual-2_8_5_1.pdf
lists two logging outputs on pg 39 (pg 40 according to Acrobat Reader) as:
"Unified Output"
and "Log File Output"
which I am guessing the former refers to the "unified" output mode... which makes me think the answer is "No, snort cannot output alerts for detected portscans to syslog."
Config file I've been using is:
alert tcp any 80 -> any any (msg:"TestTestTest"; content: "testtesttest"; sid:123) preprocessor sfportscan: proto { all } \
memcap { 10000000 } \
scan_type { all } \
sense_level { high } \
logfile { pscan.log }
(yes, very basic I know).
A simple nmap triggers output to the pscan.log
Can anyone confirm this? Or point out how I do this?
