Re: how to disable spp_porscan?

[Phil Wood <cpw () lanl gov>]

Roberto,

In case my last message was not explicit enough.  Since your snort.conf
includes and include that includes (among all the rules files), the file
named 

  snort.conf-a21

my guess is that that is another copy of the basic snort.conf rules with
the preprocessor portscan not commented out.

The important point is, there is no way portscan will get started UNLESS
you make it happen.  In this case, I think you did something like

  ls > your high level include file

and did not realize you had another conf file in the directory.  You 
might even have edited it to take out your "snort.conf".  You just
forgot the "snort.conf-a21" which I personally have never seen in my
life.  Is it something you created?  Or, does it come with some hacked
release.  It most certainly does not come from the snort distribution.

-- 
Phil Wood, cpw () lanl gov


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users