Snort detecting "TCP Portsweep" from local machine to internet

IBall · 10-21-2006, 10:42 PM

Hi,
I have a small server running Debian Sarge, with all the latest security updates applied.

I have snort running, which emails me a report every morning.

I keep getting messages like this:

Code:

Events from same host to same destination using same method
=========================================================================
 # of  from             to               method
=========================================================================
    3  65.54.188.57     192.168.1.1      WEB-MISC robots.txt access
    2  192.168.1.1      xxx.xxx.xxx.xxx    (portscan) TCP Portsweep
    2  192.168.1.1      xxx.xxx.xxx.xxx   (portscan) TCP Portsweep

(The "to" addresses I blocked out are miscellaneous machines on the internet, that are nothing to do with me)

What I would like to know is:
* What is a TCP portsweep - I guess it is some kind of port scan?
* Why is my machine portsweeping those other machines?
* Is this anything to worry about - have I been hacked?

Thanks is advance
--Ian

////// · 10-22-2006, 05:26 AM

I had that same problem with my snort. Every time when I opened Firefox and it loaded my homepage + RSS I got many false alarms becouse snort was confusing sudden increase in traffic with port scans (I was using Smoothwall at the time) , I got many alerts like:

"filtered udp portscan <- dns traffic"
"tcp portsweep <- tcp traffic to the webservers"

I fixed that with putting my local ip's to the ignore list ignore_scanners <ip_list> in snort.conf
sense_level from high to medium

http://www.snort.org/docs/snort_htma...00000000000000
http://www.securityfocus.com/archive...0/210/threaded

There is ofc possibility that it is real alert but when I was looking for solution for my alerts common advice from snort users was fine tuning snort.conf.

unSpawn · 10-22-2006, 06:46 AM

* Is this anything to worry about - have I been hacked?
Answering that requires you to 1) check what application the traffic originated from (Snort log details, tcpdumping traffic, firewall egress logging) and 2) if there's local signs of a compromise. I agree that on busy hosts a port sweep more likely than not results in false positives but it would be good to check anyway. Practice, y'know...