[Snort-users] False Alerts

Hicks, John JHicks at ...5857...
Wed Oct 9 12:17:34 EDT 2002


preprocessor stream4: disable_evasion_alerts

hth,
John

-----Original Message-----
From: Sean T. Ballard [mailto:stballard at ...4587...]
Sent: Wednesday, October 09, 2002 2:22 PM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] False Alerts


I keep getting thousands of "spp_stream4: possible EVASIVE RST detection"
alerts and cannot figure out how to disable them. I know there coming from
the stream4 pre proccessor. I am running snort 1.8.9, Demarc 1.6, and Redhat
7.3 


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users




More information about the Snort-users mailing list