[Snort-users] Frag3 doc discrepancy

Matthew K. Lee fratlee at ...11827...
Wed Aug 17 09:33:30 EDT 2005

To whom it may concern:

In the snort.conf distributed in the 2.4 snapshot rule set, Frag3 has
a minimum ttl description of:

#   min_ttl: Minimum acceptable TTL for a fragment, frags with TTLs below this
#            value will be discarded.  Default value is 0.

and the README.frag3 document has this to say:

     min_ttl <value> - Minimum acceptable TTL value for a fragment packet.
                       Default is 1.

Perhaps some clarification is in order...


Matthew Lee

More information about the Snort-users mailing list