[Snort-users] configure options for 2.9.4

John York YorkJ at ...7109...
Fri Feb 15 12:59:11 EST 2013


Hi
I'm building an IDS sensor for 2.9.4.  Can I save overhead by disabling the IPS portions?  I see that the default listed at the top of snort.conf is this:
OPTIONS : --enable-gre --enable-mpls --enable-targetbased --enable-ppm --enable-perfprofiling --enable-zlib --enable-active-response --enable-normalizer --enable-reload --enable-react --enable-flexresp3

I'm trying these changes, but they cause make to have errors:
--disable-active-response
--disable-normalizer
--disable-react
--disable-flexresp3.

It looks like everything works if I remove --disable-flexresp3.  What should be the configure options for a non-blocking IDS install?

Note:  Ubuntu 12.04.1 LTS, with these apt packages:
libpcap0.8-dev
libpcre3-dev
g++
bison
flex
make
zlib1g-dev
daq-2.0.0
libdnet-1.12

thanks
John





More information about the Snort-users mailing list