[Snort-sigs] Problems with thresholding configuration command

Chris Green cmg at ...435...
Mon Oct 13 08:29:07 EDT 2003


Brian Raines <briankraines at ...144...> writes:

> Has anyone had any luck with new thresholding features
> of snort-2.0.2?  I've been following examples in
> README.thresholding --
>
> config threshold: memcap 3000000
>
> and when I run snort, I get the following error:
>
> "FATAL ERROR: Unknown config directive: config
> threshold: memcap 3000000"
>
> Any ideas as to what I'm not understanding?

Ahh, it's a bad backport of the configuration directive from the soon
to be beta 2.1.

Should be in parser.c right after "reference_net"

  else if(!strcasecmp(config, "threshold"))
  {
        ProcessThresholdOptions(args);
        return;
  }

The memcap directive will not work in 2.0.2
-- 
Chris Green <cmg at ...435...>
I've had a perfectly wonderful evening. But this wasn't it.
     -- Groucho Marx




More information about the Snort-sigs mailing list