[Snort-users] Re: I don't get any alerts when reading from file.

dimopoulos at ...12202... dimopoulos at ...12202...
Wed Aug 4 02:51:04 EDT 2004


You are absolutely right! I could kiss you! Hell, I'm so happy I could
kiss everybody!!!That was exactly the problem. The packets I was generating had all
checksums set to 0, because when I was reading the various protocols each
said that a checksum of 0 means that no checksum is generated. It never
occured to me that snort might reject such packets.Thanks a bunch to everyone! You've been great help!

> Do the packets that you created have the correct checksums - IP, and
> tcp/udp/icmp?  If the checksums are not correct, you may not get
> alerts.  It looks like there is a configure option :
>
> config checksum_mode : none
>
> that will turn off validating checksums.
>
> Judy







More information about the Snort-users mailing list