нюхайте обнаружение проникновения

I suspect that the issue is with your snort.conf file.

Have you got the following line

include $PREPROC_RULE_PATH/preprocessor.rules

uncommented? If not, uncomment the rule to enable it and try again forcing Snort to re-read the configuration file.

You may also need to ensure the following line in snort.conf is set to high but I'm not 100% sure that it'd be necessary -

preprocessor sfportscan: proto { all } memcap { 1000000 } sense_level { high } scan_type { all }