[Snort-users] (no subject)

Santi Benito benisoroa at ...11827...
Wed May 17 05:59:02 EDT 2006


Thanks a lot Martin,but I think that I have the portscan preprocessor
disabled from the beginning. I do the probes with this preprocessor
configuration in snort.conf:

preprocessor flow: stats_interval 0 hash 2
preprocessor frag2
preprocessor stream4: disable_evasion_alerts detect_scans
preprocessor stream4_reassemble
preprocessor rpc_decode: 111 32771
preprocessor bo
preprocessor telnet_decode

I think that for my purpose, see how many alerts of only p2p traffic it
detects, I also could disable all the preprocessors, I also saw one
time that preprocessor http_inspect generated me a lot of alerts and I
disabled it.
So if have that configuration, and the problems continues existing,
what could be the cause?
My professor has told me to use tethereal,and it catches muck more
packets than snort, but at 50Mb/s begins dropping packets....so I
would like to solve the problem of snort, but I don`t know how.

Thanks a lot, I expect no to have bored you.

Santi




More information about the Snort-users mailing list