Snort Portscan Question

[KinoEye]

When I review my snort logs I see lots of entried like this:

[**] [100:1:1] spp_portscan: PORTSCAN DETECTED from XX.XX.XXX.XXX (THRESHOLD 4 connections exceeded in 2 seconds) [**]
07/10-19:06:09.285781

[**] [100:2:1] spp_portscan: portscan status from XX.XX.XXX.XXX: 2 connections across 2 hosts: TCP(2), UDP(0) [**]
07/10-19:20:43.704297

Now the problem is these scans are originating from my own IP & they seem to coincide with broswer requests, I can see them being logged as I'm surfing.

So my question is:

Is my system compromised?

If not is there a rule to stop this from being logged without leaving myself open to scans?
(I've looked high & low via google & snort.org)

My system: Mac G4, OS X 10.2.6, Snort 2.0, software firewall (IPFW) all on a glorious 56k dialup.

Any help would be appreciated.

[3r2]

spp == Snort Preprocessor Plugin
portscan == Snort Portscan Plugin

This alert was not generated by a rule, therefore no packets were captured
to log. The alert was generated by a seperate program that comes with
snort.

In snort.conf look for a line like:
preprocessor portscan: $HOME_NET 10 3 portscan.log

Which says alert on any external system hitting systems in $HOME_NET at a
rate greater than or equal to 10 systems in 3 seconds (these two numbers may
be different in your config).

Here is the thread:
http://www.geocrawler.com/mail/threa...scan&list=4890
Let me know if this is close.

[SirDice]

On that same snort.conf line you'll find the filename of a portscan.log. Take alook at it. It shows which host(s) are connecting to which port(s). See if you can post it here and somebody should be able to tell you what's going on. It maybe just regular Internet traffic.

[slarty]

You've configured snort incorrectly.

Your own IPs are supposed to be in $HOME_NET or something similar (I can't quite remember). This will prevent them from being flagged as the source of attacks.

I hope none of your users is using any P2P software, or snort becomes instantly almost useless (P2P is *WAY* too promiscuous).

P2P is the enemy of IDS.

[KinoEye]

Allright I changed the threshold in my conf file. That seems to have stopped it without affecting detection of real portscans, or at least the one I've run from pcflank.com as well as my own Nmap scans. Hopefully there will be no reoccurence <grits teeth>