[Autogenerated] the next pre processor that I want to
cover is the ports can pre processor.
This one does exactly what you think it does.
It enables us to detect port scans.
It does this by monitoring the connection attempts on TCP.
UDP ICMP and IP protocols.
As you'll see in the coming demo,
you can use this one to detect simple or robust scans.
You can analyze the responses from hosts that are probed and use the
negative responses gathered to form the basis for the rules.
These negative responses are either ICMP unreachable or
reset packets from the TCP protocol.
So the ports can inspector looks for these responses and compares them to the
rules that you have set up to indicate whether or not it will alert on the
behavior when we're trying to configure this pre processor to detect scans
there are three levels of sensitivity.
By default we have the low medium and high ports can defaults.
Here's an example of the default medium ports can setting that comes with snore.
Of course you'll want to tune this to your specific environment or
use one of the other defaults if those suit you better here we have
what protocols that will look for will identify the scan types which
ports to look for and so on.
These are all tagged variables that you can modify in
their respective configuration files,
diving a little bit more into the scan types.
You can use this pre processor to detect four different types.
port scan ports, sweep,
decoy port scan and a distributed ports can A ports can is a
1-1 scan for multiple ports on a single host.
The port's sweet option detects those one too many host scans,
looking for a single ports on the network that's open A decoy.
Port Scam is interesting because it's 1-1 as well,
but spoofed source types are used And the distributed ports can is many to one.
Looking for open ports filtering the pre processor functionality can help
improve efficiency and provide better analysis of the data.
This is because snort won't have to work as hard analyzing
the traffic that's being filtered out.
The same can be said with the analysts looking at the data too on top of this.
It's easier to sift through three events versus 100 and three or 1000 and three.
But keep in mind you don't want to tune it to the point that it doesn't work.
Take your use cases and identify what types of pork
scans you actually want to detect on.
You can filter this based on scan type number or type of
rejects the networks and the ports