snort doesn't alert other host port scanning I have this configuration:vmware debian11 running snort, vmware kali Linux running nmap that scans ports of Debian 11(real). snort doesn't alert port scanning in this case. instead if I scans ports of vmware Debian 11 running snort, it alerts snort.conf (v.2.9): preprocessor sfportscan: proto { all } \ scan_type { all } \ sense_level { high } \ logfile { alert } \ watch_ip { 192.168.1.8, 192.168.1.23 } vmware machines are in bridge any help? thanks

In order for snort to work properly, there is a need to activate the promiscuous mode on the virtual machine.
it is very simple to do, just follow these directions (for vmware player):
<