Editing snort.conf

[Guest]

[sawilla]

When I edit snort.conf, my changes are overwritten when the Intrusion Prevention System is disabled/enabled. Specifically, I need to add an "ignore_scanners { <IPs> }" directive to the sfportscan preprocesser in /etc/snort/snort/snort.conf. After doing this, if I disable then enable IPS, my changes get overwritten. How can I make the changes stick?

[mrkroket]

Probably on templates. There must be some snort.conf.tmpl near your snort.conf file....

[sawilla]

That did it, thanks!