[Snort-users] Snot attacks and -z est option - regarding FAQ 1.9
Anton A. Chuvakin
anton at ...5376...
Mon Mar 25 07:02:11 EST 2002
>Another issue is that I tried to reduce the alerts that were caused by
>snot by using the -z est option. That idea was based on my assumption
>that snot causes many fake connections, i.e. no real connections are
>established. This did not help, I still got most of the alerts.
Reeally? I experimented extensively some time ago with snort and snort.
While I was able to load the snort box somewhat by running snot, snort's
"-z" option sent the CPU load way down and drop rate to zero. ONLY alerts
that were registered were ICMP and UDP. Actually, snot does not establish
a connection AT ALL, thus "-z est" should ignore all TCP attacks sent my
snot (and it did, in my case)
Anton A. Chuvakin, Ph.D.
More information about the Snort-users