(no subject)

["Santi Benito" <benisoroa () gmail com>]

Thanks a lot Martin,but I think that I have the portscan preprocessor
disabled from the beginning. I do the probes with this preprocessor
configuration in snort.conf:

preprocessor flow: stats_interval 0 hash 2
preprocessor frag2
preprocessor stream4: disable_evasion_alerts detect_scans
preprocessor stream4_reassemble
preprocessor rpc_decode: 111 32771
preprocessor bo
preprocessor telnet_decode

I think that for my purpose, see how many alerts of only p2p traffic it
detects, I also could disable all the preprocessors, I also saw one
time that preprocessor http_inspect generated me a lot of alerts and I
disabled it.
So if have that configuration, and the problems continues existing,
what could be the cause?
My professor has told me to use tethereal,and it catches muck more
packets than snort, but at 50Mb/s begins dropping packets....so I
would like to solve the problem of snort, but I don`t know how.

Thanks a lot, I expect no to have bored you.

Santi


-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid0709&bid&3057&dat1642
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users