[Snort-devel] can't disable spp_stream4 TTL EVASION alerts ?
Kreimendahl, Chad J
Chad.Kreimendahl at ...1167...
Wed Jun 5 07:53:02 EDT 2002
That's odd... I swear they turned it off by default (think my version is
149). Must have thwaked the changes in CVS... Ahh, the power of two working
on the same part of a file at the same time...
From: Edwin Eefting [mailto:edwin at ...1392...]
Sent: Wednesday, June 05, 2002 8:47 AM
To: Snort Developers List
Subject: [Snort-devel] can't disable spp_stream4 TTL EVASION alerts ?
I'm using Version 1.9-dev (Build 155) but I still am unable to disable this
(spp_stream4) TTL EVASION (reassemble) detection
My stream4 settings:
preprocessor stream4: memcap 64000000, disable_evasion_alerts,noinspect
preprocessor stream4_reassemble: noalerts
Since I've downloaded build 155 (I had build 147 before) I also receive some
kind of new alert very often:
(snort_decoder) Unknown Datagram decoding problem!
How can I disable these alerts? (I believe the first one is a bug in
spp_stream4, there seems to be a missing check in the sourcecode) I get
flooded with these messages.
Met vriendelijke groet, /\ ___/
Edwin Eefting /- \ _/ Business Internet Trends BV
/--- \/ __________________
Don't miss the 2002 Sprint PCS Application Developer's Conference August
25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm
Snort-devel mailing list
Snort-devel at lists.sourceforge.net
More information about the Snort-devel