[SOLVED] But read this may be help your IPS custom rules

[Guest]

[rainstorm]

Hi ,
I'm very newbie.
I want to add this line to the /etc/snort/vars
portvar FILE_DATA_PORTS ($HTTP_PORTS,110,143).   (for the custom rules)

but after restart snort service that return default. (no line)
thank you.

[solution]
always edit .tmpl, .old , .conf files.

but IPS(snort) have a problem with custom rules (downloaded from snort.org with oinkmastercode.)
you must change in the all rules "threshold" to "detection_filter"

www_google.com_tr/search?hl=en&tbo=d&sclient=psy-ab&q=threshold+vs+detection_filter&oq=threshold+vs+detection_filter&gs_l=hp.3...1291333.1303535.0.1303986.29.27.0.0.0.0.560.5103.0j14j3j0j1j3.21.0.les%3B..0.0...1c.1.wyromgRI-8g&pbx=1&bpcl=40096503&biw=1280&bih=675&cad=b&cad=cbv&sei=xUnUUPbcKI-HhQeE-YHgBQ