[Snort-users] help with "disable_decode_alerts" in the config file

Erek Adams erek at ...950...
Fri Jan 24 07:33:13 EST 2003


On Thu, 23 Jan 2003 AppleAnnie331 at ...661... wrote:

> In the archives I found the solution to a problem I am having with
> "(snort_decoder) Unknown Datagram decoding problem" and ICMP messages.
> I am supposed to disable_decode_alerts in the config file.  I don't know
> where in the config file to do that.  Does it going in one of the
> preprocessor sections?  If so which one.  Thanks in advance for any help
> you can provide.

http://www.snort.org/docs/writing_rules/chap2.html#tth_sEc2.1.3

Search for 'disable_decode_alerts'.

Since this is under the 'config' section, it would be something like
"config:  disable_decode_alerts".

Always check the docs and FAQ!!  :)

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson




More information about the Snort-users mailing list