[Snort-devel] stream4 in snort2

Chris Green cmg at ...835...
Mon Nov 25 14:17:00 EST 2002


"Kreimendahl, Chad J" <Chad.Kreimendahl at ...1167...> writes:

> (spp_stream4) NMAP FINGERPRINT (stateful) detection 
>
> with the following config in dev:
> preprocessor stream4: disable_evasion_alerts, memcap <some large
> number>, timeout <seconds>
> preprocessor stream4_reassemble: both, ports all

change

        if(action & ACTION_ALERT_NMAP_FINGERPRINT)
        {

to

if(s4data.ps_alerts && (action & ACTION_ALERT_NMAP_FINGERPRINT))
{


-- 
Chris Green <cmg at ...402...>
A watched process never cores.




More information about the Snort-devel mailing list