[Snort-devel] disable warnings in snort 2.0
Andrew R. Baker
andrewb at ...835...
Sun Nov 3 10:34:02 EST 2002
Nathan W. Labadie wrote:
> Is there any way to disable protocol warnings in snort 2.0? My logs are
> filling up with the following:
> WARNING: TCP Data Offset is less than 5!
> WARNING: Truncated UDP Header!
> WARNING: Unknown Datagram decoding problem!
> I have the following in my config:
> preprocessor frag2: memcap 16777216, timeout 30, ttl_limit 0
> preprocessor stream4: timeout 10, memcap 25165824, disable_evasion_alerts, ttl_limit 0
> preprocessor stream4_reassemble: both, noalerts
> preprocessor http_decode: 80 unicode iis_alt_unicode double_encode iis_flip_slash full_whitespace
> preprocessor rpc_decode: 111 32772
> preprocessor telnet_decode
add "config disable_decode_alerts" to your config file to turn these
events off. Of course, I would be more interested in what packets are
More information about the Snort-devel