[Snort-users] Strange Alerts
neil at ...1633...
Wed Apr 23 09:43:08 EDT 2003
Artur Bittencourt <artur at ...8902...> wrote asking:
> I have the same situation here. After I´ve upgraded to Snort 2.0.0
>I´ve got a lot of alerts (more than 191000) with "(snort_decoder): T/TCP
>Detected" on my e-mail server. How do I turn this rule off ?
In your snort.conf file, look for this header ...
# Configure the snort decoder:
... and then under it:
# Stop Alerts on T/TCP alerts:
# config disable_ttcp_alerts
Uncomment the "disable" line, then re-start Snort.
Neil Dickey, Ph.D.
Northern Illinois University
More information about the Snort-users