[Snort-devel] can't disable spp_stream4 TTL EVASION alerts ?
edwin at ...1392...
Wed Jun 5 06:48:03 EDT 2002
I'm using Version 1.9-dev (Build 155) but I still am unable to disable
(spp_stream4) TTL EVASION (reassemble) detection
My stream4 settings:
preprocessor stream4: memcap 64000000, disable_evasion_alerts,noinspect
preprocessor stream4_reassemble: noalerts
Since I've downloaded build 155 (I had build 147 before) I also receive
some kind of new alert very often:
(snort_decoder) Unknown Datagram decoding problem!
How can I disable these alerts? (I believe the first one is a bug in
spp_stream4, there seems to be a missing check in the sourcecode)
I get flooded with these messages.
Met vriendelijke groet, /\ ___/
Edwin Eefting /- \ _/ Business Internet Trends BV
/--- \/ __________________
More information about the Snort-devel