[Snort-sigs] good settings for portscan preprocessor?

David Wilburn dwilburn at ...8...
Thu Nov 13 03:53:07 EST 2003

I've never had any good luck with the portscan preprocessor with Snort 
in any network I've used it on with the default settings, regardless of 
my host filtering.  Does anyone here have any recommendations on a good 
setting that they've used in a large-ish network?

By the way, I'm using the original portscan preprocessor, not portscan2, 
due to my using Snort in conjunction with SGUIL.

-Dave Wilburn

More information about the Snort-sigs mailing list