[Snort-users] Snot attacks and -z est option - regarding FAQ 1.9

Anton A. Chuvakin anton at ...5376...
Mon Mar 25 07:02:11 EST 2002


Hello all,

>Another issue is that I tried to reduce the alerts that were caused by
>snot by using the -z est option. That idea was based on my assumption
>that snot causes many fake connections, i.e. no real connections are
>established. This did not help, I still got most of the alerts.
Reeally? I experimented extensively some time ago with snort and snort.

While I was able to load the snort box somewhat by running snot, snort's
"-z"  option sent the CPU load way down and drop rate to zero. ONLY alerts
that were registered were ICMP and UDP. Actually, snot does not establish
a connection AT ALL, thus "-z est" should ignore all TCP attacks sent my
snot (and it did, in my case)

Best,
-- 
     Anton A. Chuvakin, Ph.D.
     http://www.chuvakin.org
   http://www.info-secure.org





More information about the Snort-users mailing list