[Snort-devel] frag2 alerts

Chris Green cmg at ...402...
Tue Jun 4 12:59:12 EDT 2002


"Nathan W. Labadie" <ab0781 at ...839...> writes:

> This is with the latest CVS for SNORT_1_8, using linux on an i686.
>
> I have the following in snort.conf:
> preprocessor frag2: memcap 16777216, timeout 30
>
> Note that detect_state_problems is not enabled, but I still seem to be 
> receiving alerts from spp_frag2:
>
> 06/04-09:33:18.879747  [**] [113:5:1] spp_frag2: Duplicate first fragments 
> [**] {UDP} 63.250.205.5 -> 141.x.x.x
> 06/04-09:35:48.512416  [**] [113:5:1] spp_frag2: Duplicate first fragments 
> [**] {UDP} 63.250.205.5 -> 141.x.x.x
> 06/04-09:35:49.231044  [**] [113:5:1] spp_frag2: Duplicate first fragments 
> [**] {UDP} 63.250.205.5 -> 141.x.x.x
>
> Any ideas on how to fix this?
>

CVS update :-)

Thanks for the bug report. Wish you could have done it about 12 hours
earlier :p
-- 
Chris Green <cmg at ...402...>
To err is human, to moo bovine.




More information about the Snort-devel mailing list