[Snort-users] Snort 2.3 RC1, what right to scan.log?
mkettler at ...4108...
Tue Nov 30 09:00:05 EST 2004
At 10:57 AM 11/30/2004, Bill Warren wrote:
>In Snort 2.3 RC1, what tells Snort to write to scan.log? Can you change
>the name and location of the file?
I suspect that is the portscan2 preprocessor. scan.log is it's default
I'd disable portscan2 if your snort.conf still calls it. It's not really
very useful IMO, and isn't even mentioned in 2.3's snort.conf anymore.
It could also be sfportscan. Looking at it's code however, it's hard to see
how it works if you don't specify a logfile option.
More information about the Snort-users