[Snort-users] no portscan traffic

i have flow-portscan2 enabled in snort.conf but no portscan traffic is
showing up in acid. here are my plugins

any ideas?

[root@ids1 docs]# grep preprocessor /etc/snort/snort.conf

preprocessor frag2: timeout 35, memcap 4194304, min_ttl 3, ttl_limit 8
preprocessor stream4: detect_scans, timeout 35, memcap 32000000, min_ttl 3,
preprocessor stream4_reassemble: both, ports all
preprocessor http_inspect: global proxy_alert iis_unicode_map
preprocessor http_inspect_server: server default profile all ports { 80 443 }
preprocessor http_inspect_server: server 207.241.152.130 bare_byte no
preprocessor http_inspect_server: server 207.241.153.143 bare_byte no
preprocessor http_inspect_server: server 207.241.152.242 bare_byte no
preprocessor http_inspect_server: server 207.241.152.249 bare_byte no
preprocessor flow: stats_interval 0 hash 2
preprocessor flow-portscan: \
preprocessor rpc_decode: 111 32771
#preprocessor bo
preprocessor telnet_decode
#preprocessor arpspoof #preprocessor arpspoof_detect_host:
192.168.40.1 f0:0f:00:f0:0f:00


thanks
adam


-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=4721&alloc_id=10040&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users