Re: sfportscan tuning

[Joel Esler <joel.esler () sourcefire com>]

Take a look at the snort.conf file in the etc/ directory.  All your  
config options are in there.  The README is in doc/

J

On Mar 11, 2008, at 8:10 PM, Kamran Shafi wrote:

> Hi all,
>
> Do I need to change the threshold settings of portscan preprocessor  
> in src/preprocessors/portscan.c  or is there a softer way of  
> changing the thresholds for the alerts generated by this  
> preprocessor??
>
> Do I need to uninstall Snort first when I modify the .c file and  
> then recompile? I earlier installed Snort using the package manager,  
> I guess after doing this change I will just need to follow the  
> standard sequence of make
>
> make clean
> ./configure
> make
> make install
>
> Am I right or missing some step? Sorry if its a very basic question  
> - just didn't want to stuff up my existing setup.
>
> --
> Regards
> Kam  
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2008.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/_______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


--
Joel Esler  joel.esler () sourcefire com




-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users