[Snort-users] Lots of "spp_stream4: TTL EVASION (reasemble) "

Augustinho Catto Catto at ...6458...
Thu Jul 25 17:29:05 EDT 2002

Dear gurus:
Since I installed snort 1.87 version I received lots of alerts kind 
"spp_stream4: TTL EVASION (reassemble) detection ".
It happened in spite of fact I�ve already set:
"preprocessor stream4: disable_evasion_alerts" and
"preprocessor stream4_reassemble: noalerts" in snort.conf.
In this network exists a "Total Control" which receive dial-up 
How could avoid this false alerts?

Augustinho Valmor CATTO
CNE - Analista de Suporte 
UNISINOS - Universidade do Vale do Rio dos Sinos
Sao Leopoldo - RS - Brasil
Phone: +55 xx 51 590-8386
"From Brazil the land of FIFA worldwide soccer five times 

More information about the Snort-users mailing list