[Snort-devel] can't disable spp_stream4 TTL EVASION alerts ?

Edwin Eefting edwin at ...1392...
Wed Jun 5 06:48:03 EDT 2002

I'm using Version 1.9-dev (Build 155) but I still am unable to disable
this alert:

 (spp_stream4) TTL EVASION (reassemble) detection 

My stream4 settings:
preprocessor stream4: memcap 64000000, disable_evasion_alerts,noinspect
preprocessor stream4_reassemble: noalerts 

Since I've downloaded build 155 (I had build 147 before) I also receive
some kind of new alert very often:

 (snort_decoder) Unknown Datagram decoding problem! 

How can I disable these alerts? (I believe the first one is a bug in
spp_stream4, there seems to be a missing check in the sourcecode)
I get flooded with these messages.

Met vriendelijke groet,      /\ ___/          
Edwin Eefting               /- \ _/  Business Internet Trends BV
                           /--- \/           __________________

More information about the Snort-devel mailing list