Snort Custom RDP port
Hi community, I need to change the default RDP port from 3389 to a custom one to make the IPS RDP protection rules work.
I can't find where to do this, the web interface only allows to change some predefined ports.
Are there any files to configure this?
bmeeks last edited by
You will need to change the port (where specified) in the individual rules you have enabled. Using a
modifysid.conffile on the SID MGMT tab is the best way to do this. The SID MGMT feature uses Perl regex. There are some examples of the syntax in the various
*-sample.conffiles included on the tab.
There is no pre-defined RDP Port variable in the standard configuration. You could certainly define one, but still you would need to modify the appropriate rules in order to have them reference it.