Snort mailing list archives

Re: config profile_rules


From: Joel Esler <jesler () sourcefire com>
Date: Fri, 4 Jun 2010 13:07:35 -0400

It enables the same compile options that we have in the Sourcefire product (like enable-ppm), I have redundancy in my 
compile tags.  I know.

On Jun 4, 2010, at 12:56 PM, Jefferson, Shawn wrote:

What does --enable-sourcefire do?
 
From: Joel Esler [mailto:jesler () sourcefire com] 
Sent: Friday, June 04, 2010 9:12 AM
To: Pedro Marinho
Cc: snort-users () lists sourceforge net
Subject: Re: [Snort-users] config profile_rules
 
You need to compile performance monitoring in.
 
These are my compile tags:
 
--enable-sourcefire --enable-reload --enable-targetbased --enable-zlib --enable-ipv6 --enable-gre --enable-mpls 
--enable-pp
m --enable-perfprofiling
 
 
On Jun 4, 2010, at 12:01 PM, Pedro Marinho wrote:


Hello Joel,

I am disabling some rules here to improve performance. I was reading at your blog 

http://blog.joelesler.net/2010/04/fun-with-profile_rules.html

so i put that config option on the snort.conf
like this:

config profile_rules

but i am receiving an error when i up snort 

snort -q -c /etc/snort/snort.conf -i eth2 -A console -N

this error

ERROR: Unknown config directive: config profile_rules
Fatal Error, Quitting..

do u know what am i doing wrong? 


 
--
Joel Esler
302-223-5974
Jabber: jesler () sourcefire com
 

--
Joel Esler
302-223-5974
Jabber: jesler () sourcefire com

------------------------------------------------------------------------------
ThinkGeek and WIRED's GeekDad team up for the Ultimate 
GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the 
lucky parental unit.  See the prize list and enter to win: 
http://p.sf.net/sfu/thinkgeek-promo
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Current thread: