[Snort-users] spp_stream4: TTL EVASION (reassemble) detection

McCammon, Keith Keith.McCammon at ...3497...
Fri Sep 20 07:46:02 EDT 2002


Read your comments in snort.conf: 
 
disable_evasion_alerts - turn off the possibly noisy mitigation of overlapping sequences.
 
You can uncomment this in the stream4 options.

-----Original Message-----
From: Pedro Tedeschi [mailto:pedro.tedeschi at ...6753...]
Sent: Friday, September 20, 2002 10:32 AM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] spp_stream4: TTL EVASION (reassemble) detection


Hi, whats means this rule? 
"spp_stream4: TTL EVASION (reassemble) detection"
 
I didn't find  this one in the rules path, and i'm recieve more than 56000 attacks about this rule ...
 
Is this rule are important? If not, i would like to know, how i can remove this rule ...
 
 
Thanks in advance
 
 
Cheers,
 
Pedro Tedeschi

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20020920/5dffe80f/attachment.html>


More information about the Snort-users mailing list