[Snort-users] snort packet decoder in snort.conf
hchlai at ...2792...
Tue Feb 8 10:49:18 EST 2005
I have been recorded the following alerts on my sensors:
snort_decoder: Truncated Tcp Options
snort_decoder: Short UDP packet, length field > payload length
snort_decoder: Experimental TCP options
snort_decoder: Unknown Datagram decoding problem
snort_decoder: Tcp Options found with bad lengths.
snort_decoder: TCP Data Offset is less then 5!
Can someone please give dig into this subject? I understand that these alerts are generated before they are passed to the preprocessors and are related to abnormal protocols, but what packets makes Snort to disqualify them and generate an alert?
Switch to Netscape Internet Service.
As low as $9.95 a month -- Sign up today at http://isp.netscape.com/register
Netscape. Just the Net You Need.
New! Netscape Toolbar for Internet Explorer
Search from anywhere on the Web and block those annoying pop-ups.
Download now at http://channels.netscape.com/ns/search/install.jsp
More information about the Snort-users