[Snort-devel] Stream 4 Question

Brent Erickson ericksonb at ...2853...
Mon Jan 23 18:29:01 EST 2006


Hello Snort developers,

I am a long time Snort user.

I have been using Snort since version 1.6 and currently run version 2.43.

Is it possible to run the Stream 4 processor with "disable_evasion 
_alerts enabled, but some how disable evasive reset alerts that are 
always seen with HTTP browsing resets?

I'd like to run the processor with "disable_evasion_alerts removed from 
the default configuration but the evasive reset alerts go off constantly.

Many thanks for your help and time.

Sincerely,

Brent Erickson





More information about the Snort-devel mailing list