[Snort-users] spp_stream4 false positives..

Preston Kutzner grdnwsl at ...6600...
Mon Aug 12 11:38:02 EDT 2002

This is probably a dumb question, but I'm getting a LOT of
"(spp_stream4) possible EVASIVE RST detection" alerts since upgrading
to 1.9.0beta2.  I was just wondering if there is a way to turn this
particular alert off, seeing as how it's a preprocessor, and not in
the "rules" per-se.  I'm still a newbie at using snort, and I was just
curious on how to solve this problem, as I didn't have it with 1.8.7.
Thanks in advance.

Preston Kutzner | IT Manager
Marketing Resources, Inc.

The information transmitted is intended only for the person or entity to
which it is addressed and may contain confidential and/or privileged
material.  Any review, retransmission, dissemination or other use of, or
taking of any action in reliance upon, this information by persons or
entities other than the intended recipient is prohibited.   If you received
this in error, please contact the sender and delete the material from any

More information about the Snort-users mailing list