Timothy,
These alerts are caused by preprocessors, not rules.
From the Snort manual...
Preprocessors are loaded and configured using the preprocessor
keyword. The format of the preprocessor directive in the Snort rules
file is:
preprocessor <name>: <options>
You can read more about each preprocessor in the Snort manual.
Specifically, http://www.snort.org/docs/snort_htmanuals/htmanual_280/node35.html
I hope this puts you on the right track to accomplish your task.
Please feel free to post any further questions!
Happy Holidays,
Chris
On Dec 27, 2007, at 6:44 PM, Timothy Ding wrote:
Dear list,
i have commented everything in the default snort.conf leaving only 1
but results shows portscan and http_inspect to name a few, where can
i remove these?
Initializing rule chains...
1 Snort rules read
1 detection rules
0 decoder rules
0 preprocessor rules
1 Option Chains linked into 1 Chain Headers
0 Dynamic rules
Thanks
Tim
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
