Topic: portscan.log

[sabu]

i've had multiple people test their portscans on me and none of the portscans are coming up in my portscan.log or snort alert..

is it meant to be like this?

sabu

[Dan]

Well, maybe.  Check to ensure that snort is running:

ps -x | grep snort

Are you running guardian?  If you are, then they will be blocked and you will not see any more activity from their IP.

[sabu]

snort doesn't seem to be running, and https://www/acid is having database problems aswell..

should i uninstall reinstall? is so, how?

or is there another way to fix it?

sabu

[steve]

Do not uninstall...yet...
something similar happened to me when my dhcp address changed
I noticed that the database was not getting updated
I had to update my external IP in /etc/snort/snort.conf  file (replace the old with the new)
then start (or restart) snortd using the full path to the file
on my server
/etc/rc.d/init.d/snortd

try that

[Dan]

Or simply do a:

/sbin/e-smith/expand-template /etc/snort/snort.conf

/etc/rc.d/init.d/snortd restart