[Snort-users] Rules that fire on bad checksums?

Glenn Forbes Fleming Larratt glratt at ...604...
Tue Sep 7 07:53:01 EDT 2004


tcpdump will make noise when an IP or embedded protocol checksum is bad.

I cannot find anything in the Snort manual that would alert on that
condition - is there any such thing, either in the rules or in a plugin?

	-g

				Glenn Forbes Fleming Larratt
				Rice University Networking
				glratt at ...604...




More information about the Snort-users mailing list