[Snort-users] Help to configure SNORT

Matt Kettler mkettler at ...4108...
Tue Dec 23 13:39:01 EST 2003

At 04:25 PM 12/23/2003, Lorenzo Rossi wrote:

>Could you help me to solve this problem?

Ok, you made it to snort-users... did you get the rest of my message? I 
made the effort to offer some suggestions about your problem itself, and 
you reposted your question without any changes to reflect that you'd tried 
my suggestions.

You should be able to get rid of these by configuring spp_stream4 with 

This is also the default setting in the default snort.conf, so I'm not sure 
why you've been getting these alerts.

Do you already have disable_evasion_alerts as a parameter to spp_stream4 in 
your snort.conf?

More information about the Snort-users mailing list