Re: [Snort-users] spp_fnord Alerts Galore

The deafault sensitivity level of the fnord preprocessor can be adjusted via a compile define in the fnord processor, MAXNOP

The default values of 128 is very small (thus too sensitive) for links with lots of compressed binary data such as streaming audio. Increment this value in multiples of four (I usually use 512) to increase the length of the possible sled it must find before going off.

Change it and recompile.
I'll release a new one shortly with this as a preprocessor option but I'm kinda swamped right now with conference stuff and the Snort book.

cheers,
--dr

On 25 Feb 2003 08:38:29 -0700
Joe Giles <jgiles@joeman1.com> wrote:

> List,

-- 
--dr                  pgpkey: 
http://dragos.com/dr-dursec.asc
        0 = 1 , for large values of zero and small values of one.


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users