[Snort-users] (no subject)
benisoroa at ...11827...
Wed May 17 05:59:02 EDT 2006
Thanks a lot Martin,but I think that I have the portscan preprocessor
disabled from the beginning. I do the probes with this preprocessor
configuration in snort.conf:
preprocessor flow: stats_interval 0 hash 2
preprocessor stream4: disable_evasion_alerts detect_scans
preprocessor rpc_decode: 111 32771
I think that for my purpose, see how many alerts of only p2p traffic it
detects, I also could disable all the preprocessors, I also saw one
time that preprocessor http_inspect generated me a lot of alerts and I
So if have that configuration, and the problems continues existing,
what could be the cause?
My professor has told me to use tethereal,and it catches muck more
packets than snort, but at 50Mb/s begins dropping packets....so I
would like to solve the problem of snort, but I don`t know how.
Thanks a lot, I expect no to have bored you.
More information about the Snort-users