 | PortScan PluginThe port scan plug in for snort, or just portscan for short is intended to be used in conjunction with snort and logcheck. |
| Download | |
PortScan Plugin Ranking & Summary
Advertisement
PortScan Plugin Tags
PortScan Plugin Description
The port scan plug in for snort, or just portscan for short is intended to be used in conjunction with snort and logcheck. The port scan plug in for snort, or just portscan for short is intended to be used in conjunction with snort and logcheck. The tool will allow you to monitor your snort log file and then do port scans based upon certain keywords.This program requires nmap and snort. If you want it to run automatically you will also need logcheck. Hopefully in the future this program will be built to run as a daemon and will no longer rely on logcheck. But for now use logcheck.Make sure that Snort is set to log to syslog and that you know which syslog file it is logging to. The contents of the file will look like this :Jul 6 18:34:00 thqms3 snort: IDS126/x11_Outgoing_Xterm: 212.30.119.109:6000 -> 63.80.88.42:33248To install first run install.shAfter running install.sh you may edit the portscan.conf file in /etc/portscan and the keywords file. After making any necassary changes you will need to add the following lines into your logcheck.sh file/usr/sbin/portscan.pl &cat $TMPDIR/checkoutput.$$ > $TMPDIR/portscan.logSo your logcheck.sh file should now look like this (toward the bottom)
PortScan Plugin Related Software