[Snort-users] Help to configure SNORT

Matt Kettler mkettler at ...4108...
Tue Dec 23 13:39:01 EST 2003


At 04:25 PM 12/23/2003, Lorenzo Rossi wrote:

>Could you help me to solve this problem?

Ok, you made it to snort-users... did you get the rest of my message? I 
made the effort to offer some suggestions about your problem itself, and 
you reposted your question without any changes to reflect that you'd tried 
my suggestions.


----------------
You should be able to get rid of these by configuring spp_stream4 with 
disable_evasion_alerts.

This is also the default setting in the default snort.conf, so I'm not sure 
why you've been getting these alerts.
----------------

Do you already have disable_evasion_alerts as a parameter to spp_stream4 in 
your snort.conf?






More information about the Snort-users mailing list