Snort mailing list archives
sfportscan tuning
From: "Kamran Shafi" <kamran.shafi () gmail com>
Date: Wed, 12 Mar 2008 11:10:19 +1100
Hi all, Do I need to change the threshold settings of portscan preprocessor in src/preprocessors/portscan.c or is there a softer way of changing the thresholds for the alerts generated by this preprocessor?? Do I need to uninstall Snort first when I modify the .c file and then recompile? I earlier installed Snort using the package manager, I guess after doing this change I will just need to follow the standard sequence of make make clean ./configure make make install Am I right or missing some step? Sorry if its a very basic question - just didn't want to stuff up my existing setup. -- Regards Kam
------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- sfportscan tuning Kamran Shafi (Mar 11)
- Re: sfportscan tuning Joel Esler (Mar 11)
- Message not available
- Re: sfportscan tuning Kamran Shafi (Mar 11)
- Re: sfportscan tuning Joel Esler (Mar 12)
- Re: sfportscan tuning Kamran Shafi (Mar 12)
- Message not available
- Re: sfportscan tuning Joel Esler (Mar 11)