[Snort-users] spp_stream4

Jason Gauthier jgauthier at ...6155...
Tue Jul 9 14:03:13 EDT 2002

I have started snort up, and am fine tuning my rules. I'm getting this
message ALOT.
It comes from the same system everytime.  My transparent web proxy.

I'm not really understanding what's going on. I'm guessing that this is the
stream4 preprocessor and the message is coming up because it's transparently
sending it to another box.

My question then, since this is a "false positive", is what can I do about
ignoring it?

Thanks kindly,


spp_stream4: TCP CHECKSUM CHANGED ON RETRANSMISSION (possible fragroute)

More information about the Snort-users mailing list