[Snort-users] sfportscan tuning

Kamran Shafi kamran.shafi at ...11827...
Tue Mar 11 20:10:19 EDT 2008


Hi all,

Do I need to change the threshold settings of portscan preprocessor in
src/preprocessors/portscan.c  or is there a softer way of changing the
thresholds for the alerts generated by this preprocessor??

Do I need to uninstall Snort first when I modify the .c file and then
recompile? I earlier installed Snort using the package manager, I guess
after doing this change I will just need to follow the standard sequence of
make

make clean
./configure
make
make install

Am I right or missing some step? Sorry if its a very basic question - just
didn't want to stuff up my existing setup.

-- 
Regards
Kam
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20080312/b3452e6d/attachment.html>


More information about the Snort-users mailing list