[Snort-users] checksum_mode

Bamm Visscher bamm.visscher at ...11827...
Mon Sep 5 09:41:05 EDT 2005


The option is most often used in my experience when replaying
previously captured traffic (especially traffic that has been
sanitized) and it's not normally something you need to deal with.  See
Richard Bejtlich's post on the subject [0].

Bammkkkk

[0] http://taosecurity.blogspot.com/2005/04/using-snorts-k-option-i-was-looking.html

On 9/5/05, Pablo Nebrera <pablonebrera at ...13472...> wrote:
> 
> 
>         I don't understand this option in the snort configuration file.
> Does it check the checksum for every packet? What is the checksum of a
> packet?
> 
> What does this option do exactly??
> 
> Thanks
> 
> 
> Pablo

-- 
sguil - The Analyst Console for NSM
http://sguil.sf.net




More information about the Snort-users mailing list