stream4 preprocessor question

["Miller, Eoin" <Miller () fhlb-of com>]

ive been reading through the past posts and ive seen how to turn off the stream4 preprocessor, however i want to have 
it on to detect portscans, but i want to turn off the EVASIVE RST alerts that are being generated.

--begin snip snort.conf---

preprocessor stream4: detect_scans

---end snip snort.conf---


if i was to change the above current entry to this:

preprocessor stream4: detect_scans,noalerts

would that still log the portscans and nothing else or no? i am using snort version 1.8.7-db (Build 128)


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users