[Snort-sigs] Problems with thresholding configuration command

Chris Green cmg at ...435...
Mon Oct 13 08:29:07 EDT 2003

Brian Raines <briankraines at ...144...> writes:

> Has anyone had any luck with new thresholding features
> of snort-2.0.2?  I've been following examples in
> README.thresholding --
> config threshold: memcap 3000000
> and when I run snort, I get the following error:
> "FATAL ERROR: Unknown config directive: config
> threshold: memcap 3000000"
> Any ideas as to what I'm not understanding?

Ahh, it's a bad backport of the configuration directive from the soon
to be beta 2.1.

Should be in parser.c right after "reference_net"

  else if(!strcasecmp(config, "threshold"))

The memcap directive will not work in 2.0.2
Chris Green <cmg at ...435...>
I've had a perfectly wonderful evening. But this wasn't it.
     -- Groucho Marx

More information about the Snort-sigs mailing list