[Snort-users] (spp_stream4) TTL LIMIT Exceeded

John Hally JHally at ...5637...
Fri Apr 18 06:19:03 EDT 2003


Need a little help here, as I'm not to well versed in the spp_stream4
preprocessor.  Why would I be getting alerted to the below, even though the
trace looks legitimate, and the TTL value in the trace is 3?  


-----Original Message-----
From: ACID Alert [mailto:acid at ...8926...]
Sent: Friday, April 18, 2003 9:15 AM
To: jhally at ...5637...
Subject: ACID Incident Report

Generated by ACID v0.9.6b22 on Fri, 18 Apr 2003 09:15:26 -0400

#9-16506| [2003-04-18 08:44:32] -> xxx.xxx.xxx.33:80
[snort/15]  (spp_stream4) TTL LIMIT Exceeded

More information about the Snort-users mailing list