[Snort-users] how to disable "Short UDP packet, length field" alert?

sb ch chulmin22 at ...125...
Sun Jun 15 19:31:07 EDT 2003


Hello, all.

I would like to disable this function, but I can't find any rule file 
related.
So this alert has nothing related rule files.
How can I disable this logging?
Surely, I did like below, but alerts are continued.

var HOME_NET any ![210.xx.xx.xxx]
var EXTERNAL_NET any ![210.xx.xx.xxx] 


[**] [116:97:1] (snort_decoder): Short UDP packet, length field > payload 
length [**]
06/16-11:16:14.651421 210.xx.xx.xxx:0 -> xxx.xxx.145.78:0
UDP TTL:254 TOS:0x0 ID:40445 IpLen:20 DgmLen:2596
Len: 2568


Thanks in advance.

_________________________________________________________________
도처에 도사리는 재해의 위험들. AIG의 무료보험으로 해결하세요.   
http://www.msn.co.kr/webinclude/exredir.asp?STARTID=CLIP_5644&adgroup=KRMGEN&URL=http://msn.aigis.co.kr/weekly_msn/main.asp 
 





More information about the Snort-users mailing list