I have not found anywhere how to configure and use sfportscan in snort 3; all documentation I can find is for snort 2. I am aware of this answer, which applies to snort 2.9, and I don't think it helps me here.

As far as I understood, I need to put it into the stream = {} object in my snort.lua file, but what is the syntax for that? I tried multiple different ways, and all result in errors.

For example: in the documentation here, an example configuration is given like this:

preprocessor flow: stats_interval 0 hash 2 preprocessor sfportscan: proto { all } \ scan_type { all } \ sense_level { low }

Furthermore, is there any good documentation on how to "detect" portscans through this? I need to set up a rule afterwards in the preprocessor rules, correct? Right now, I can detect some things that happen when a portscan is done (through community rules), but they do not detect the port scan explicitly:

Snort output against an nmap port scan

I'm sure there must be a better way to detect them!

I found that in my snort_defaults.lua file, there are a few configurations for port scans and that in my snort.lua config file, some kind of port scan detection is configured:

port_scan = default_hi_port_scan

which refers to the configuration in the defaults. Is this correct?

  • 1
    One question at a time please. What do you want to know most: how to configure sfportscan or how to detect port scans once you configure it?
    – schroeder
    Jun 21, 2021 at 9:24
  • Yes, sorry. I would like to be able to detect port scans like in step 6 in this answer: stackoverflow.com/questions/52411580/…
    – mneumann
    Jun 21, 2021 at 9:31
  • 1
    I suggest you to install snort 2.9, there are a lot of documentation
    – user268418
    Oct 13, 2021 at 15:19


You must log in to answer this question.

Browse other questions tagged .