[Snort-users] Strange Alerts

Neil Dickey neil at ...1633...
Wed Apr 23 09:43:08 EDT 2003


Artur Bittencourt <artur at ...8902...> wrote asking:

>         I have the same situation here. After I´ve upgraded to Snort 2.0.0 
>I´ve got a lot of alerts (more than 191000) with "(snort_decoder): T/TCP 
>Detected" on my e-mail server. How do I turn this rule off ?

In your snort.conf file, look for this header ...

  # Configure the snort decoder:
  # ============================
  #

... and then under it:

  # Stop Alerts on T/TCP alerts:
  #
  # config disable_ttcp_alerts
  #

Uncomment the "disable" line, then re-start Snort.

Best regards,

Neil Dickey, Ph.D.
Research Associate/Sysop
Geology Department
Northern Illinois University
DeKalb, Illinois
60115






More information about the Snort-users mailing list