Snort mailing list archives
Re: Proper Method and/or Place to Declare HTTP_SERVERS port?
From: Erek Adams <erek () theadamsfamily net>
Date: Wed, 8 May 2002 14:06:09 -0700 (PDT)
On Wed, 8 May 2002, Vadim Pushkin wrote:
I am using port 8180 versus port 80. I would prefer not messing around with all of the rules files. I've noticed that the rules files themselves specify port 80, but my servers are listening on port 8180. Is there a way to change this in the snort.conf file? I've tried setting: preprocessor http_decode: 8180 -unicode -cginull but I still get alarms for hosts possibly port scanning my HTTP_SERVERS.
And you will continue to. :) The http_decode preprocessor has _nothing_ to do with the rules. It strictly deals with 'normalizing' the URLs before snort runs them thru the rulesets. You'll need to manually (or via a script) change port 80 in each of the *.rules to port 8180. Cheers! ----- Erek Adams Nifty-Type-Guy TheAdamsFamily.Net _______________________________________________________________ Have big pipes? SourceForge.net is looking for download mirrors. We supply the hardware. You get the recognition. Email Us: bandwidth () sourceforge net _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Proper Method and/or Place to Declare HTTP_SERVERS port? Vadim Pushkin (May 08)
- Re: Proper Method and/or Place to Declare HTTP_SERVERS port? Erek Adams (May 08)
- Re: Proper Method and/or Place to Declare HTTP_SERVERS port? Matt Kettler (May 08)
- <Possible follow-ups>
- Re: Proper Method and/or Place to Declare HTTP_SERVERS port? Vadim Pushkin (May 08)
- Re: Proper Method and/or Place to Declare HTTP_SERVERS port? Erek Adams (May 08)
- Re: Proper Method and/or Place to Declare HTTP_SERVERS port? Vadim Pushkin (May 09)