[Snort-users] spp_anomsensor: Anomaly threshold exceeded in alert.log

Erek Adams erek at ...577...
Mon Sep 9 02:51:02 EDT 2002


On Mon, 9 Sep 2002 francisv at ...6732... wrote:

> I'm logging all alerts to MySQL but why is Snort producing
> /var/log/snort/alert? Here's the content (and continuously growing):
>
> [**] [104:1:1] spp_anomsensor: Anomaly threshold exceeded: 13.3085 [**]
> 09/09-14:29:10.585623 195.159.0.151:40167 -> 202.91.161.5:8081
> TCP TTL:49 TOS:0x20 ID:49962 IpLen:20 DgmLen:60 DF
> ******S* Seq: 0xF030EEA5  Ack: 0x0  Win: 0x16D0  TcpLen: 40
> TCP Options (5) => MSS: 1460 SackOK TS: 2591895224 0 NOP WS: 0

Use 'snort -N <other options>'.

[...]

[erek at ...3978...]/var/log/snort#snort -\?
Initializing Output Plugins!

-*> Snort! <*-
Version 1.9.0beta6 (Build 202)
By Martin Roesch (roesch at ...1935..., www.snort.org)
USAGE: snort [-options] <filter options>
Options:

[...snip...]
        -N         Turn off logging (alerts still work)
[...snip...]

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net





More information about the Snort-users mailing list