[Snort-users] sfportscan tuning
kamran.shafi at ...11827...
Tue Mar 11 20:10:19 EDT 2008
Do I need to change the threshold settings of portscan preprocessor in
src/preprocessors/portscan.c or is there a softer way of changing the
thresholds for the alerts generated by this preprocessor??
Do I need to uninstall Snort first when I modify the .c file and then
recompile? I earlier installed Snort using the package manager, I guess
after doing this change I will just need to follow the standard sequence of
Am I right or missing some step? Sorry if its a very basic question - just
didn't want to stuff up my existing setup.
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-users