[Snort-users] spp_stream4: TTL EVASION (reassemble)

Jonathan Baker jb at ...6531...
Mon Aug 19 10:36:02 EDT 2002


I have been told that in order to disable these alerts I should set
ttl_limit to 0, but I am not sure in what file this should be set.  I tried
setting it in the snort.conf file as listed here "preprocessor stream4:
detect_scans, disable_evasion_alerts, timeout 0" but that seems not to have
worked.  Can anyone help?

I'm running snort 1.8.7.


More information about the Snort-users mailing list