Snort Custom RDP port

[jere7em]

Hi community, I need to change the default RDP port from 3389 to a custom one to make the IPS RDP protection rules work.
I can't find where to do this, the web interface only allows to change some predefined ports.
Are there any files to configure this?

Thanks

[bmeeks]

You will need to change the port (where specified) in the individual rules you have enabled. Using a modifysid.conf file on the SID MGMT tab is the best way to do this. The SID MGMT feature uses Perl regex. There are some examples of the syntax in the various *-sample.conf files included on the tab.

There is no pre-defined RDP Port variable in the standard configuration. You could certainly define one, but still you would need to modify the appropriate rules in order to have them reference it.