[Snort-devel] another stream4 problem

Vitaly Osipov vosipov at ...440...
Mon Jul 2 08:26:32 EDT 2001


or maybe it's not a problem, but - after running today's snort for a
couple of hours with stream4 turned on, i've got this:

spp_stream4: STEALTH ACTIVITY detection      16814 (12%)   
spp_stream4: EVASIVE RST detection      3172 (2%)    
spp_stream4: EVASIVE RETRANSMISSION detection      4491 (3%)   
spp_stream4: WINDOW VIOLATION detection      55097 (40%)  

number on the right are alert counts :)))

what does this all mean? (dont tell me that it's normal and that my
servers have stupid MS tcp/ip stack - they do not (at least most of
them) :) )


regards,
Vitaly.




More information about the Snort-devel mailing list