snort sfportscan日志文件輸出不具有event_id，而是event_ref且值為0

Question

我的配置如下：

preprocessor sfportscan: proto { all } \
scan_type  { all } \
sense_level { high } \
logfile { alert }

當我運行snort並使用nmap進行掃描時，日志文件輸出如下：

Time: 02/23-12:54:21.183932 
event_ref: 0
[Source ip address] -> [Destination ip address] (portscan) TCP Portscan
Priority Count: 9
Connection Count: 10
IP Count: 1
Scanner IP Range: [Destination ip address]:[Destination ip address]
Port/Proto Count: 10
Port/Proto Range: 981:12174

但是snort文檔是這樣說的：

Time: 09/08-15:07:31.603880
event_id: 2
192.168.169.3 -> 192.168.169.5 (portscan) TCP Filtered Portscan
Priority Count: 0
Connection Count: 200
IP Count: 2
Scanner IP Range: 192.168.169.3:192.168.169.4
Port/Proto Count: 200
Port/Proto Range: 20:47557

如果目標上有開放端口，將附加一個或多個其他帶標記的數據包：

Time: 09/08-15:07:31.603881
event_ref: 2
192.168.169.3 -> 192.168.169.5 (portscan) Open Port
Open Port: 38458

我沒有event_id，而是event_ref，其值為0