sfportscan tuning

["Kamran Shafi" <kamran.shafi () gmail com>]

Hi all,

Do I need to change the threshold settings of portscan preprocessor in
src/preprocessors/portscan.c  or is there a softer way of changing the
thresholds for the alerts generated by this preprocessor??

Do I need to uninstall Snort first when I modify the .c file and then
recompile? I earlier installed Snort using the package manager, I guess
after doing this change I will just need to follow the standard sequence of
make

make clean
./configure
make
make install

Am I right or missing some step? Sorry if its a very basic question - just
didn't want to stuff up my existing setup.

-- 
Regards
Kam

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users