Re: portscan vs. portscan2

["Rob Burris" <robeb () keepthevibe com>]

*This message was transferred with a trial version of CommuniGate(tm) Pro*
A couple things...

1. Is it necessary to have both preprocessor's running?
2. What are some of the differences between how they detect scans?
3. Is one better than the other or is it just personal preference?

I hope I don't sound like a lamer but as you said there doesn't appear to be
any docs to read.

- Rob B.

----- Original Message -----
From: "Erek Adams" <erek () snort org>
To: "Rob Burris" <robeb () keepthevibe com>
Cc: <snort-users () lists sourceforge net>
Sent: Thursday, February 13, 2003 9:48 PM
Subject: Re: [Snort-users] portscan vs. portscan2


> *This message was transferred with a trial version of CommuniGate(tm) Pro*
>  On Thu, 13 Feb 2003, Rob Burris wrote:
>
> > Hello, I'm new to the list.
>
> Welcome to our little corner of Insanity.  ;-)
>
> > Can someone please tell me where I can find more information about these
> > two preprocessors? I was unable to find what I was looking for in the
> > docs or FAQ's.
>
> Nope.
>
> There isn't really any docs on either of those two.  The best docs that I
> can point you at are the source code for them--Which isn't perhaps what
> you need.  :-/
>
> What kind of info are you looking for about those two?
>
> -----
> Erek Adams
>
>    "When things get weird, the weird turn pro."   H.S. Thompson



-------------------------------------------------------
This SF.NET email is sponsored by: FREE  SSL Guide from Thawte
are you planning your Web Server Security? Click here to get a FREE
Thawte SSL guide and find the answers to all your  SSL security issues.
http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0026en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users