[Snort-devel] new pb on snort v2 ? (icmp large packet)

rmkml rmkml at ...1042...
Wed Apr 23 10:39:01 EDT 2003


ok thanks,

and stream4/SFE preproc ?

and other pb : 'multi ack packets' ?

Regard.



Chris Green wrote:

> rmkml <rmkml at ...1042...> writes:
>
> > but how to make then ?
> > (for look icmp large packet event on snort v2)
> >
>
> Currently, create a different rule with dsize + itype for it or
> disable the icmp-info rules.
> --
> Chris Green <cmg at ...402...>
> This is my signature. There are many like it but this one is mine.





More information about the Snort-devel mailing list