[Snort-users] Only local.rules

waldo kitty wkitty42 at ...14940...
Wed Jun 12 12:42:03 EDT 2013


On 6/12/2013 12:15, Nicholas Horton wrote:
> What's the easiest way to disable all rules (preprocessor, text, so, etc) and only use the local.rules file?

1. comment out all other rules includes except local.rules
2. disable unwanted preprocessors
3. some preprocessors are required (frag3, stream5) so suppress them by GID

-- 
NOTE: No off-list assistance is given without prior approval.
       Please keep mailing list traffic on the list unless
       private contact is specifically requested and granted.




More information about the Snort-users mailing list