I have install Snort & acidbase by this instruction and access it through this local address
127.0.0.1/acidbase/base_main.php
The problem is after scan it with nmap by this command
sudo nmap -p1-65535 -sV -sS -O [Snort Installed IP Address]
by another computer in the network witch have ping connectivity, it show nothing in Portscan Traffic and it is always 0% . I am sure the configuration is okay because it record everything else and alerts shows up in the Alert cache.
Any idea why Snort Don't show port scan activity ?
Edited :
I uncomment "preprocessor sfportscan" , restart snort service ,portscaned with nmap , result : nothing.
preprocessor sfportscan: proto { all } memcap { 10000000 } sense_level { high }
I entered my exact ip address in "ipvar HOME_NET" , restart snort service , portscaned with another pc ,result : nothing.
the line include
$PREPROC_RULE_PATH/preprocessor.rules
is commented so there is no preprocessor.rules file in that path.