[Snort-users] spp_stream4: TTL EVASION (reassemble)
jb at ...6531...
Mon Aug 19 10:36:02 EDT 2002
I have been told that in order to disable these alerts I should set
ttl_limit to 0, but I am not sure in what file this should be set. I tried
setting it in the snort.conf file as listed here "preprocessor stream4:
detect_scans, disable_evasion_alerts, timeout 0" but that seems not to have
worked. Can anyone help?
I'm running snort 1.8.7.
More information about the Snort-users