[Snort-devel] disabling stream4 alerts
Nathan W. Labadie
ab0781 at ...839...
Thu May 30 07:09:04 EDT 2002
This is with the latest CVS for SNORT_1_8, using linux on an i686.
I have the following in snort.conf:
preprocessor stream4: timeout 10, memcap 25165824, disable_evasion_alerts
preprocessor stream4_reassemble: both, noalerts
For some reason I'm still getting a _huge_ amount of alerts, all these:
spp_stream4: TTL EVASION (reassemble) detection
Is there any way to disable this? I'm 99% sure I have the options in
snort.conf correct... any ideas?
NOTE: I'm not on the list, please include me in the reply.
Nathan W. Labadie | ab0781 at ...839...
Sr. Security Specialist | 313-577-2126
Wayne State University | 313-577-1338 fax
C&IT Information Security Office: http://security.wayne.edu
More information about the Snort-devel