Snort: Facebook and Portscan Blocking
-
All,
Has anyone encountered over the past few weeks (starting early August) that Snort (even on low sensitivity for portscan config) is regularly blocking certain Facebook server IPs (edge-*-shv-##-iad#.facebook.com). The limited information on these suggests that they are part of the 3rd party website [visit] tracking, but are required when users use/access Facebook? Occurs sporadically - have not been able to forcibly re-create, but occurs several times per week. Sometimes a day or two goes by without it occurring and then it might occur a couple times in one day.
Reference Log information:
- 122,17,1,"(portscan) UDP Portscan"
- Attempted Information Leak,2,alert,Allow
Unfortunately, the ability to simply 'click' on the rule link (via alerts window) appears to be no longer valid - removing the 'easy' means to more readily determine what is happening.
Seems rather odd (if not unexpected) and wondered if anyone else had encountered this, as well.
FWIW - use of Facebook aside, the fact that Snort perceives this as an inbound 'portscan' is what garnered attention.
Thanks!