portscan preprocessor and scan rules

[Fabrizio Tivano <fabrizio () sad it>]

Hello dear all, 

I have one question using spp_portscan preprocessor:

When scan preprocessor is enabled I see on my logs the spp_portscan messages,
if i disable the preprocessor, what's happen?
snort use the scan-rules  in order to make the same thing ?
or this king of scan (logged by preprocessor)
cannot be seen? 


TIA
fabrizio


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users