[Snort-users] sfportscan - open ports

Jeremy Hewlett jh at ...1935...
Mon Apr 4 13:37:10 EDT 2005


On Fri, Apr 01, Hin wrote:
> Thanks Jeremy... I believe I'll wait for 2.4 to come out. I can't
> find the patch that you indicated on the web, but any assistance
> would be appreciated.  

That's because there isn't a patch on the web ;) Instructions for
using CVS can be found at:
http://www.snort.org/got_source/source.html.

> I'm just curious that since sfportscan is a preprocessor, I would
> think that threshold.conf will not work on it.

Thresholding is independent of whether or not an Event comes from a
preprocessor or rule.




More information about the Snort-users mailing list