[Snort-users] sfportscan tuning

Kamran Shafi kamran.shafi at ...11827...
Tue Mar 11 20:10:19 EDT 2008

Hi all,

Do I need to change the threshold settings of portscan preprocessor in
src/preprocessors/portscan.c  or is there a softer way of changing the
thresholds for the alerts generated by this preprocessor??

Do I need to uninstall Snort first when I modify the .c file and then
recompile? I earlier installed Snort using the package manager, I guess
after doing this change I will just need to follow the standard sequence of

make clean
make install

Am I right or missing some step? Sorry if its a very basic question - just
didn't want to stuff up my existing setup.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20080312/b3452e6d/attachment.html>

More information about the Snort-users mailing list