[Snort-users] snort packet decoder in snort.conf

Hugo hchlai at ...2792...
Tue Feb 8 10:49:18 EST 2005

I have been recorded the following alerts on my sensors:

snort_decoder: Truncated Tcp Options
snort_decoder: Short UDP packet, length field > payload length
snort_decoder: Experimental TCP options
snort_decoder: Unknown Datagram decoding problem
snort_decoder: Tcp Options found with bad lengths.
snort_decoder: TCP Data Offset is less then 5!

Can someone please give dig into this subject? I understand that these alerts are generated before they are passed to the preprocessors and are related to abnormal protocols, but what packets makes Snort to disqualify them and generate an alert?

Many thanks!


Switch to Netscape Internet Service.
As low as $9.95 a month -- Sign up today at http://isp.netscape.com/register

Netscape. Just the Net You Need.

New! Netscape Toolbar for Internet Explorer
Search from anywhere on the Web and block those annoying pop-ups.
Download now at http://channels.netscape.com/ns/search/install.jsp

More information about the Snort-users mailing list