[Snort-users] Pre-processor Tuning
roesch at ...1935...
Mon Jan 28 18:58:05 EST 2002
Hm, there's likely no easy way to do this unfortunately. Some of the
preprocessors take tuning data, which one are you referring to in
On 1/28/02 4:23 PM, "Bob Wallis" <gobroncos at ...3420...> wrote:
> It seems that my snort box is doing a good job of decoding packets with, for
> instance, the unidecode pre-processor. However, all the alerts are with
> sources from my network. Can I tune that somehow?
> In rules, it's clear that one defines variables for the source that do not
> include one's local network. Can the same be done for the pre-processors?
> I've looked around in confs and docs and I'm not seeing it.
> Many thanks,
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> Snort-users list archive:
Martin Roesch - Founder/CEO Sourcefire Inc. - (410) 552-6999
Sourcefire: Professional Snort Sensor and Management Console appliances
roesch at ...1935... - http://www.sourcefire.com
Snort: Open Source Network IDS - http://www.snort.org
More information about the Snort-users