[Snort-devel] autodetect config option

Todd Wease twease at ...402...
Mon Aug 6 08:18:51 EDT 2007


snort user wrote:
> Greetings.
>
> Regarding the autodetect configuration in dcerpc preprocessor -
> if this option is turned on, is it supposed to check traffic (auto
> detection) on all ports ? or just the standard ports (135,139, 445 etc
> ?)
>
> Thanks

Yes, it will check traffic on all ports and look into a small portion of
the payload to determine whether or not a packet might be DCE/RPC
traffic.  See the doc/README.dcerpc for more information on the
preprocessor.

Todd




More information about the Snort-devel mailing list