[Snort-devel] disable warnings in snort 2.0

Nathan W. Labadie ab0781 at ...839...
Sun Nov 3 09:58:13 EST 2002

Is there any way to disable protocol warnings in snort 2.0? My logs are
filling up with the following:

WARNING: TCP Data Offset is less than 5! 
WARNING: Truncated UDP Header!
WARNING: Unknown Datagram decoding problem!

I have the following in my config: 
preprocessor frag2: memcap 16777216, timeout 30, ttl_limit 0
preprocessor stream4: timeout 10, memcap 25165824, disable_evasion_alerts, ttl_limit 0 
preprocessor stream4_reassemble: both, noalerts 
preprocessor http_decode: 80 unicode iis_alt_unicode double_encode iis_flip_slash full_whitespace
preprocessor rpc_decode: 111 32772 
preprocessor telnet_decode 

Thanks much,

Nathan W. Labadie       | ab0781 at ...839...	
Sr. Security Specialist | 313-577-2126
Wayne State University  | 313-577-1338 fax
C&IT Information Security Office: http://security.wayne.edu

More information about the Snort-devel mailing list