The options that give you errors won't cause overhead if you don't use them.  And if you aren't inline, you can't use the normalizer.<br><br>That said, please send your error output to <a href="mailto:bugs@...1935...">bugs@...1935...</a> and we'll get that addressed.<br>
<br>Thanks<br>Russ<br><br><div class="gmail_quote">On Fri, Feb 15, 2013 at 12:59 PM, John York <span dir="ltr"><<a href="mailto:YorkJ@...16101......" target="_blank">YorkJ@...7109...</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0pt 0pt 0pt 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
Hi<br>
I'm building an IDS sensor for 2.9.4.  Can I save overhead by disabling the IPS portions?  I see that the default listed at the top of snort.conf is this:<br>
OPTIONS : --enable-gre --enable-mpls --enable-targetbased --enable-ppm --enable-perfprofiling --enable-zlib --enable-active-response --enable-normalizer --enable-reload --enable-react --enable-flexresp3<br>
<br>
I'm trying these changes, but they cause make to have errors:<br>
--disable-active-response<br>
--disable-normalizer<br>
--disable-react<br>
--disable-flexresp3.<br>
<br>
It looks like everything works if I remove --disable-flexresp3.  What should be the configure options for a non-blocking IDS install?<br>
<br>
Note:  Ubuntu 12.04.1 LTS, with these apt packages:<br>
libpcap0.8-dev<br>
libpcre3-dev<br>
g++<br>
bison<br>
flex<br>
make<br>
zlib1g-dev<br>
daq-2.0.0<br>
libdnet-1.12<br>
<br>
thanks<br>
John<br>
<br>
<br>
------------------------------------------------------------------------------<br>
Free Next-Gen Firewall Hardware Offer<br>
Buy your Sophos next-gen firewall before the end March 2013<br>
and get the hardware for free! Learn more.<br>
<a href="http://p.sf.net/sfu/sophos-d2d-feb" target="_blank">http://p.sf.net/sfu/sophos-d2d-feb</a><br>
_______________________________________________<br>
Snort-users mailing list<br>
<a href="mailto:Snort-users@lists.sourceforge.net">Snort-users@...4626...ceforge.net</a><br>
Go to this URL to change user options or unsubscribe:<br>
<a href="https://lists.sourceforge.net/lists/listinfo/snort-users" target="_blank">https://lists.sourceforge.net/lists/listinfo/snort-users</a><br>
Snort-users list archive:<br>
<a href="http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users" target="_blank">http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users</a><br>
<br>
Please visit <a href="http://blog.snort.org" target="_blank">http://blog.snort.org</a> to stay current on all the latest Snort news!<br>
</blockquote></div><br>