[Snort-devel] can't disable spp_stream4 TTL EVASION alerts ?

Kreimendahl, Chad J Chad.Kreimendahl at ...1167...
Wed Jun 5 07:53:02 EDT 2002

That's odd... I swear they turned it off by default (think my version is
149).  Must have thwaked the changes in CVS... Ahh, the power of two working
on the same part of a file at the same time...  

-----Original Message-----
From: Edwin Eefting [mailto:edwin at ...1392...] 
Sent: Wednesday, June 05, 2002 8:47 AM
To: Snort Developers List
Subject: [Snort-devel] can't disable spp_stream4 TTL EVASION alerts ?

I'm using Version 1.9-dev (Build 155) but I still am unable to disable this

 (spp_stream4) TTL EVASION (reassemble) detection 

My stream4 settings:
preprocessor stream4: memcap 64000000, disable_evasion_alerts,noinspect
preprocessor stream4_reassemble: noalerts 

Since I've downloaded build 155 (I had build 147 before) I also receive some
kind of new alert very often:

 (snort_decoder) Unknown Datagram decoding problem! 

How can I disable these alerts? (I believe the first one is a bug in
spp_stream4, there seems to be a missing check in the sourcecode) I get
flooded with these messages.

Met vriendelijke groet,      /\ ___/          
Edwin Eefting               /- \ _/  Business Internet Trends BV
                           /--- \/           __________________


Don't miss the 2002 Sprint PCS Application Developer's Conference August
25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm

Snort-devel mailing list
Snort-devel at lists.sourceforge.net

More information about the Snort-devel mailing list