[Snort-users] preprocessor alert

ll ibeginhere at ...11827...
Wed Aug 4 05:30:37 EDT 2010


hi,all
the preprocess create too many alerts. for example "stream5: Limit on 
number of overlapping TCP packets reached".whether I disabled the 
preprocessor stream5 or some way can disabled there alerts ? which will 
be better ? and if I want to disabled some alerts created by the 
preprocessor when I know the the preprocessor SID,how to do that .I just 
know how to disabled the rules when I know the rules SID.





More information about the Snort-users mailing list