[Snort-users] ssp_conversion BAD IP protocol, why?

Mike Koponick mkoponick at ...7385...
Mon May 5 06:47:30 EDT 2003

Hello all,

I seem to be having a reoccurring issue with Snort. I receive millions
of these messages in my snort log. I tried commenting out the SID (118)
in the gen-msg file, but no go. 

Does anyone know how I can get rid of these things? They seem to report
on packets that are typical on the network.

05/05-06:40:45.325111  [**] [118:1:1] (spp_conversation) Bad IP
protocol! [**] {UDP} xxx.xxx.xxx.xxx:514 -> xxx.xxx.xxx.xxx:514

Thanks in advance


More information about the Snort-users mailing list