[Snort-devel] Snort 2.1.1-RC1

Kevin Amorin kevmcs11 at ...398...
Sat Feb 21 16:12:01 EST 2004

   I was hoping someone could help on a couple of
behavior issues:

I have in my conf:

config disable_decode_alerts
config disable_tcpopt_experimental_alerts
config disable_tcpopt_obsolete_alerts
config disable_ttcp_alerts
config disable_tcpopt_alerts
config disable_ipopt_alerts

and am still seeing

snort: TCP Data Offset(24) < longer than payload(20)!
ICMP Unreachable IP short header (8 bytes)
ICMP Unreachable IP short header (8 bytes)

also I assume this is an easy fix in flow-portscan:

if I set 

    scoreboard-rows-scanner 1 \
    scoreboard-memcap-scanner 140 \

less then 1,140 I receieve

Unable to initialize the flow cache!-- try more memory
(current memcap is 31457280)

which should be something simple in scoreboard.c


Do you Yahoo!?
Yahoo! Mail SpamGuard - Read only the mail you want.

More information about the Snort-devel mailing list