Re: removing default rules

[Christopher Jacob <chris.jacob () sourcefire com>]

Timothy,

These alerts are caused by preprocessors, not rules.

 From the Snort manual...

Preprocessors are loaded and configured using the preprocessor  
keyword. The format of the preprocessor directive in the Snort rules  
file is:

preprocessor <name>: <options>

You can read more about each preprocessor in the Snort manual.

Specifically, http://www.snort.org/docs/snort_htmanuals/htmanual_280/node35.html

I hope this puts you on the right track to accomplish your task.  
Please feel free to post any further questions!

Happy Holidays,

Chris



On Dec 27, 2007, at 6:44 PM, Timothy Ding wrote:

> Dear list,
>
> i have commented everything in the default snort.conf leaving only 1  
> but results shows portscan and http_inspect to name a few, where can  
> i remove these?
>
> Initializing rule chains...
> 1 Snort rules read
>     1 detection rules
>     0 decoder rules
>     0 preprocessor rules
> 1 Option Chains linked into 1 Chain Headers
> 0 Dynamic rules
>
>
> Thanks
> Tim
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2005.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/_______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users