preprocessor ftp_telnet_protocol: \ telnet \ ports { 23 } \ normalize \ ayt_attack_thresh 6 \ detect_anomalies
There should only be a single telnet configuration, and subsequent instances will override previously set values.