[Snort-users] Interesting issue..

James Lay jlay at ...13475...
Fri Sep 2 07:47:03 EDT 2005


Hey All!

So yea....I have two machines...both running Snort-2.4.0.  Both have:

preprocessor stream4_reassemble: both,ports [all]

in the config

Now...what's interesting is that one machine gives me:

snort[2159]: WARNING /etc/snort/snort.conf(375) => flush_behavior set in
config file, using old static flushpoints (0) 

on restart, but the other does not.  Any way I can track down the
difference?  I've added flush_behavior large_window to the machine that
gave the above line and all is right in the cosmos now.  Was just
curious.

Both machines are running slackware 10.1 with snort compiled with no
compile options.

James




More information about the Snort-users mailing list