[Snort-sigs] good settings for portscan preprocessor?
dwilburn at ...8...
Thu Nov 13 03:53:07 EST 2003
I've never had any good luck with the portscan preprocessor with Snort
in any network I've used it on with the default settings, regardless of
my host filtering. Does anyone here have any recommendations on a good
setting that they've used in a large-ish network?
By the way, I'm using the original portscan preprocessor, not portscan2,
due to my using Snort in conjunction with SGUIL.
More information about the Snort-sigs