[Snort-devel] disabling stream4 alerts

Nathan W. Labadie ab0781 at ...839...
Thu May 30 07:09:04 EDT 2002


This is with the latest CVS for SNORT_1_8, using linux on an i686.

I have the following in snort.conf:

preprocessor stream4: timeout 10, memcap 25165824, disable_evasion_alerts
preprocessor stream4_reassemble: both, noalerts

For some reason I'm still getting a _huge_ amount of alerts, all these:

spp_stream4: TTL EVASION (reassemble) detection

Is there any way to disable this? I'm 99% sure I have the options in 
snort.conf correct... any ideas?

Thanks,
Nate

NOTE: I'm not on the list, please include me in the reply.

-- 
Nathan W. Labadie       | ab0781 at ...839...	
Sr. Security Specialist | 313-577-2126
Wayne State University  | 313-577-1338 fax
C&IT Information Security Office: http://security.wayne.edu





More information about the Snort-devel mailing list