[Snort-sigs] syn/fin scans from stream4

Vincent Vono vincent.vono at ...1538...
Thu Aug 28 11:08:05 EDT 2003

Hi all,

Anyone know how to pass syn/fin scans from a specific source address? The
events are being triggered by the preprocessor stream4. I have a production
scanner, when scanning, this event is triggered. Want to stop this from
triggering from this specific source address.

I've searched thru the docs but find nothing.


******************* PLEASE NOTE *******************
This E-Mail/telefax message and any documents accompanying this
transmission may contain privileged and/or confidential information and is
intended solely for the addressee(s) named above.  If you are not the
intended addressee/recipient, you are hereby notified that any use of,
disclosure, copying, distribution, or reliance on the contents of this
E-Mail/telefax information is strictly prohibited and may result in legal
action against you. Please reply to the sender advising of the error in
transmission and immediately delete/destroy the message and any
accompanying documents.  Thank you.

More information about the Snort-sigs mailing list