format

Snort - the de facto standard for intrusion detection/prevention

the de facto standard in IPS

Search Site

Search Rules

Account

email
password

not registered?

user preferences

Next: Frag 3 Alert Output Up: Frag3 Previous: Frag 3 Configuration Contents

format

**Figure 2.4:** Example configuration (Basic)
$\begin{figure}\begin{verbatim}preprocessor frag3_global preprocessor frag3_engine\end{verbatim} \par\end{figure}$

**Figure 2.5:** Example configuration (Advanced)
$\begin{figure}\begin{verbatim}preprocessor frag3_global: prealloc_nodes 8192 ... ...sor frag3_engine: policy last, detect_anomalies\end{verbatim} \par\end{figure}$

Note in the advanced example (Figure 2.5), there are three engines specified running with Linux, first and last policies assigned. The first two engines are bound to specific IP address ranges and the last one applies to all other traffic. Packets that don't fall within the address requirements of the first two engines automatically fall through to the third one.

Steven Sturges 2008-04-01