Re: how to disable spp_porscan?

[Phil Wood <cpw () lanl gov>]

Roberto,

There is no way that the portscan preprocessor will run if you have
commented it out of your config file.  Since you have shown us a config file
with it commented out.  Run snort without the quiet option, and send us
the command line you use to start snort as well as the configuration file.

If you do know what the command line is, reflect on how snort gets started,
and root around in whatever directories you might have on whatever operating
system you are using to find the incantation.

The configuration file name on the command line should be the same as the
name of the file whose contents you append in your reply to this message.
Also, depending on who designed you configuration, you might have "include"
files in your "conf" file which negate anything you think you might have
done to turn off portscan. 

And finally, the next time you request help.  Please include information
like.  Operating system you are running, version of that operating system,
where you obtained snort, who compiled it, who configured it, what
version are you running, what snort command line options you use, the
contents of your configuration file, and in addition anything else that
might help someone figure out what the hell you are doing.

On Tue, Dec 18, 2001 at 08:12:17PM +0100, Roberto Suarez Soto wrote:
> On Dec/18, Chris Green wrote:
>
> > Ok. Please do.  Also please include the alerts you are complaining
> > about so we can tell you what to disable.
>
>       I've done so in another reply in this thread, you can see all this in
> it. Tell me if you need any other info :-)
>
> -- 
> Roberto Suarez Soto                                   Alfa21 Outsourcing
>     robe () alfa21 com                                     http://www.alfa21.com
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

-- 
Phil Wood, cpw () lanl gov


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users