[Snort-sigs] Problems with thresholding configuration command (Annual Leave)

Justin Hennessy jhennessy at ...340...
Mon Oct 13 09:30:01 EDT 2003


I will be on annual leave from the 13th to the 24th of October.

>>> snort-sigs 10/14/03 00:58 >>>

Brian Raines <briankraines at ...144...> writes:

> Has anyone had any luck with new thresholding features
> of snort-2.0.2?  I've been following examples in
> README.thresholding --
>
> config threshold: memcap 3000000
>
> and when I run snort, I get the following error:
>
> "FATAL ERROR: Unknown config directive: config
> threshold: memcap 3000000"
>
> Any ideas as to what I'm not understanding?

Ahh, it's a bad backport of the configuration directive from the soon
to be beta 2.1.

Should be in parser.c right after "reference_net"

  else if(!strcasecmp(config, "threshold"))
  {
        ProcessThresholdOptions(args);
        return;
  }

The memcap directive will not work in 2.0.2
-- 
Chris Green <cmg at ...435...>
I've had a perfectly wonderful evening. But this wasn't it.
     -- Groucho Marx


-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
SourceForge.net hosts over 70,000 Open Source Projects.
See the people who have HELPED US provide better services:
Click here: http://sourceforge.net/supporters.php
_______________________________________________
Snort-sigs mailing list
Snort-sigs at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs





More information about the Snort-sigs mailing list