[Snort-users] stream4: possible EVASIVE RST <-> EVASIVE RST

Steffen Maetzky (extern) Steffen.Maetzky at ...11508...
Thu Apr 15 03:16:05 EDT 2004


Hello,

1) I'd like to know how stream4 decides which events are possible
EVASIVE RST or EVASIVE RST.

I think that it depends to the flags which are set.
Does anyone know which flags are generating this events?

2) Are there known uncritical processes which are creating these alerts?

Thanks in advance,

Steffen





More information about the Snort-users mailing list