[Snort-devel] Stream4 oddity2

Kreimendahl, Chad J Chad.Kreimendahl at ...1167...
Tue Apr 30 12:47:16 EDT 2002


Sorry about this, I meant to include it, but have had quite a bit going on
today:

Here's my stream4 setup: w/ 126 and 133
preprocessor stream4: detect_scans, disable_evasion_alerts, memcap 67108864,
timeout 30

I get massive amounts of "spp_stream4: TCP CHECKSUM CHANGED ON
RETRANSMISSION (possible fragroute) detection " even with
'disable_evasion_alerts'

Anyone?




More information about the Snort-devel mailing list