Is this a Linux box?  If so, have you considered using the native
IPTables logging?  It's easy to configure and OSSEC can read it by
default:
http://www.ossec.net/wiki/Know_How:Iptables_Config

Regards,
-- 
Doug Burks, GSE, CISSP
President, Greater Augusta ISSA
http://augusta.issa.org
http://securityonion.blogspot.com

On Sun, Oct 31, 2010 at 3:59 PM, Js Opdebeeck <[email protected]> wrote:
> Hello;
>
> I'd like to have report in case of network port scan, but I don't want
> to use Snort. There is a post about 'iplog', but this tool is really
> old.
>
> On solution is to work with portsentry or scanlogd.
>
> This last one is really easy to install.
>
> --
> syslog:Oct 31 20:12:23 O0O0O0O0 scanlogd: 192.168.2.101:53 to
> 192.168.2.103 ports 199, 995, 8080, 53, 5900, 445, 1720, 587,
> 8888, ..., fSrpauxy, TOS 00 @19:12:23
> syslog:Oct 31 20:36:23 O0O0O0O0 scanlogd: 192.168.2.101 to
> 192.168.2.103 ports 199, 22, 1, 113, 3389, 1720, 111, 110, ..., ??
> r?????, TOS 00 @19:27:49
> syslog:Oct 31 20:42:10 O0O0O0O0 scanlogd: 192.168.2.101:50438 to
> 192.168.2.103 ports 8888, 25, 443, 21, 587, 1025, 3389, 3306, ...,
> fSrpauxy, TOS 00 @19:42:10
> syslog:Oct 31 20:46:02 O0O0O0O0 scanlogd: 192.168.2.101:45282 to
> 192.168.2.103 ports 111, 25, 993, 8080, 1720, 3389, 110, 143, ...,
> fSrpauxy, TOS 00 @19:46:02
> syslog:Oct 31 20:46:39 O0O0O0O0 scanlogd: 192.168.2.101:39448 to
> 192.168.2.103 ports 995, 199, 139, 23, 143, 113, 3389, ..., fSrpauxy,
> TOS 00 @19:46:39
> syslog:Oct 31 20:47:02 O0O0O0O0 scanlogd: 192.168.2.101:34736 to
> 192.168.2.103 ports 80, 111, 554, 1025, 443, 993, 587, ..., fSrpauxy,
> TOS 00 @19:47:02
> syslog.1:Oct 29 12:40:52 O0O0O0O0 scanlogd: 127.0.0.1:52042 to
> 127.0.0.1 ports 445, 8080, 21, 554, 23, 995, 443, 1025, ..., fSrpauxy,
> TOS 00 @10:40:52
> syslog.1:Oct 29 12:41:13 O0O0O0O0 scanlogd: 192.168.177.102:62651 to
> 192.168.177.102 ports 1723, 25, 110, 1025, 3306, 8888, 22, 111, ...,
> f??pauxy, TOS 00 @10:41:13
> --
>
>
> Is someone already created ossec rules for this ?
> If not , I'll try to do this, but I don't want to reinvent the wheel.
>
> Js Op de Beeck

Reply via email to