[Snort-devel] disable warnings in snort 2.0

Andrew R. Baker andrewb at ...835...
Sun Nov 3 10:34:02 EST 2002


Nathan W. Labadie wrote:
> Is there any way to disable protocol warnings in snort 2.0? My logs are
> filling up with the following:
> 
> WARNING: TCP Data Offset is less than 5! 
> WARNING: Truncated UDP Header!
> WARNING: Unknown Datagram decoding problem!
> 
> I have the following in my config: 
> ---snip--- 
> preprocessor frag2: memcap 16777216, timeout 30, ttl_limit 0
> preprocessor stream4: timeout 10, memcap 25165824, disable_evasion_alerts, ttl_limit 0 
> preprocessor stream4_reassemble: both, noalerts 
> preprocessor http_decode: 80 unicode iis_alt_unicode double_encode iis_flip_slash full_whitespace
> preprocessor rpc_decode: 111 32772 
> preprocessor telnet_decode 
> ---snip---
> 

add "config disable_decode_alerts" to your config file to turn these 
events off.  Of course, I would be more interested in what packets are 
generating these....

-A





More information about the Snort-devel mailing list