Re: Query on ClamAV preprocessor in snort-2.3.3

[Jason Haar <Jason.Haar () trimble co nz>]

Will Metcalf wrote:

> ok, so just initialize clamav after "preprocessor stream4_reassemble"
> in your snort.conf and viola, you are scanning the reassembled
> streams.
>  
Sorry for not stating that before. That was documented and I did do it - 
no go:

preprocessor stream4: disable_evasion_alerts, ttl_limit 10
preprocessor stream4_reassemble: ports 21 23 25 53 80 110 111 143 513 
1433 1570
preprocessor clamav: ports all !22 !443, toclientonly, dbdir 
/var/ftp/pub/tools/clamav-devel/share/clamav/,  dbreload-time 43200, \
file-descriptor-mode, descriptor-temp-dir /dev/shm/clamav
preprocessor http_inspect: global iis_unicode_map unicode.map 1252
preprocessor http_inspect_server: server default profile all no_alerts 
ports { 80 81 3128 8080 } oversize_dir_length 500

--
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1



-------------------------------------------------------
This SF.Net email is sponsored by Oracle Space Sweepstakes
Want to be the first software developer in space?
Enter now for the Oracle Space Sweepstakes!
http://ads.osdn.com/?ad_id=7393&alloc_id=16281&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users