Snort configuration -- Defining ports of interest

This segment of Snort configuration discusses how channel professionals can define ports of interest.

Following the IP variables come three port variables:

var HTTP_PORTS 80
var SHELLCODE_PORTS !80
var ORACLE_PORTS 1521

The defaults are acceptable, but it makes sense to include ports relevant to the environment. For example, if the monitored network offers Web servers on port 8000, 8080 and 8888, add those to the HTTP_PORTS variable.


Snort: Understanding the configuration file

  Introduction: Upgrade to Snort 2.6.1.2
  The snort.conf file
  Defining IP ranges of interest
 Defining ports of interest
  Core preprocessors
  Non-dynamic preprocessors
  Conclusion

About the author
Richard Bejtlich is founder of TaoSecurity, author of several books on network security monitoring, including Extrusion Detection: Security Monitoring for Internal Intrusions, and operator of the TaoSecurity blog.

This was first published in January 2007

Dig deeper on Network security products, technologies, services

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

MicroscopeUK

SearchCloudProvider

SearchSecurity

SearchStorage

SearchNetworking

SearchCloudComputing

SearchConsumerization

SearchDataManagement

SearchBusinessAnalytics

Close