Snort (IDS) Don't show Port Scans

Question

I have install Snort & acidbase by this instruction and access it through this local address

127.0.0.1/acidbase/base_main.php

The problem is after scan it with nmap by this command

sudo nmap -p1-65535 -sV -sS -O [Snort Installed IP Address]

by another computer in the network witch have ping connectivity, it show nothing in Portscan Traffic and it is always 0% . I am sure the configuration is okay because it record everything else and alerts shows up in the Alert cache.

Any idea why Snort Don't show port scan activity ?

Edited :

I uncomment "preprocessor sfportscan" , restart snort service ,portscaned with nmap , result : nothing.

preprocessor sfportscan: proto { all } memcap { 10000000 } sense_level { high }

I entered my exact ip address in "ipvar HOME_NET" , restart snort service , portscaned with another pc ,result : nothing.

the line include

$PREPROC_RULE_PATH/preprocessor.rules

is commented so there is no preprocessor.rules file in that path.

Answer 1

One needs to know your snort.conf and other Snort settings to answer this. Still I shall try to answer with whatever limited information you have provided.

In all probability, the threshold settings for the portscan preprecessor (called as sfportscan if I remember correctly) are set to some higher (default) value in your snort.conf, and the portscan you did could not cross those threshold values. Another reason could be that your $HOME_NET variable is defined in such a way that the IP you are scanning is not in your HOME_NET and thus Snort doesn't care about scans on it. There could be other reasons too, such as the IP you are using to scan as well as the target IP, both are part of your HOME_NET, and thus again Snort does not care about a HOME_NET-to-HOME_NET scan.

Answer 2

You need to uncomment those lines, ie make it

include $PREPROC_RULE_PATH/preprocessor.rules

just enabling the sfportscan wont do all, you still have to enable the rules and action once portscan is detected.