[Snort-users] spp_stream4 false positives..

Preston Kutzner grdnwsl at ...6600...
Mon Aug 12 13:57:02 EDT 2002


Hello Keith,

Monday, August 12, 2002, 1:44:20 PM, you wrote:

MK> Un-comment disable_evasion_alerts in snort.conf.

>> -----Original Message-----
>> From: Preston Kutzner [mailto:grdnwsl at ...6600...]
>> Sent: Monday, August 12, 2002 2:36 PM
>> To: snort-users at lists.sourceforge.net
>> Subject: [Snort-users] spp_stream4 false positives..
>> 
>> 
>> This is probably a dumb question, but I'm getting a LOT of
>> "(spp_stream4) possible EVASIVE RST detection" alerts since upgrading
>> to 1.9.0beta2.  I was just wondering if there is a way to turn this
>> particular alert off, seeing as how it's a preprocessor, and not in
>> the "rules" per-se.  I'm still a newbie at using snort, and I was just
>> curious on how to solve this problem, as I didn't have it with 1.8.7.
>> Thanks in advance.
>> 
>> -- 
>> Preston Kutzner | IT Manager
>> Marketing Resources, Inc.
>> 
>> _________________________________________________________________
>> The information transmitted is intended only for the person 
>> or entity to
>> which it is addressed and may contain confidential and/or privileged
>> material.  Any review, retransmission, dissemination or other 
>> use of, or
>> taking of any action in reliance upon, this information by persons or
>> entities other than the intended recipient is prohibited.   
>> If you received
>> this in error, please contact the sender and delete the 
>> material from any
>> computer.
>> 
>> 
>> 
>> -------------------------------------------------------
>> This sf.net email is sponsored by: Dice - The leading online job board
>> for high-tech professionals. Search and apply for tech jobs today!
>> http://seeker.dice.com/seeker.epl?rel_code=31
>> _______________________________________________
>> Snort-users mailing list
>> Snort-users at lists.sourceforge.net
>> Go to this URL to change user options or unsubscribe:
>> https://lists.sourceforge.net/lists/listinfo/snort-users
>> Snort-users list archive:
>> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>> 


MK> -------------------------------------------------------
MK> This sf.net email is sponsored by: Dice - The leading online job board
MK> for high-tech professionals. Search and apply for tech jobs today!
MK> http://seeker.dice.com/seeker.epl?rel_code1
MK> _______________________________________________
MK> Snort-users mailing list
MK> Snort-users at lists.sourceforge.net
MK> Go to this URL to change user options or unsubscribe:
MK> https://lists.sourceforge.net/lists/listinfo/snort-users
MK> Snort-users list archive:
MK> http://www.geocrawler.com/redir-sf.php3?list

Thanks for the help... it worked.

--
Preston Kutzner | IT Manager
Marketing Resources, Inc.

_________________________________________________________________
The information transmitted is intended only for the person or entity to
which it is addressed and may contain confidential and/or privileged
material.  Any review, retransmission, dissemination or other use of, or
taking of any action in reliance upon, this information by persons or
entities other than the intended recipient is prohibited.   If you received
this in error, please contact the sender and delete the material from any
computer.





More information about the Snort-users mailing list