jgauthier at ...6155...
Tue Jul 9 14:03:13 EDT 2002
I have started snort up, and am fine tuning my rules. I'm getting this
It comes from the same system everytime. My transparent web proxy.
I'm not really understanding what's going on. I'm guessing that this is the
stream4 preprocessor and the message is coming up because it's transparently
sending it to another box.
My question then, since this is a "false positive", is what can I do about
spp_stream4: TCP CHECKSUM CHANGED ON RETRANSMISSION (possible fragroute)
More information about the Snort-users