[Snort-users] sfportscan tuning

Joel Esler joel.esler at ...1935...
Tue Mar 11 20:24:52 EDT 2008


Take a look at the snort.conf file in the etc/ directory.  All your  
config options are in there.  The README is in doc/

J

On Mar 11, 2008, at 8:10 PM, Kamran Shafi wrote:

> Hi all,
>
> Do I need to change the threshold settings of portscan preprocessor  
> in src/preprocessors/portscan.c  or is there a softer way of  
> changing the thresholds for the alerts generated by this  
> preprocessor??
>
> Do I need to uninstall Snort first when I modify the .c file and  
> then recompile? I earlier installed Snort using the package manager,  
> I guess after doing this change I will just need to follow the  
> standard sequence of make
>
> make clean
> ./configure
> make
> make install
>
> Am I right or missing some step? Sorry if its a very basic question  
> - just didn't want to stuff up my existing setup.
>
> -- 
> Regards
> Kam  
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2008.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/_______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


--
Joel Esler  joel.esler at ...1935...




-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20080311/4c09396e/attachment.html>


More information about the Snort-users mailing list