[Snort-users] Bad segment question

James Lay jlay at ...13475...
Mon Jun 14 13:43:02 EDT 2010


Hey Group.

So I have a question...I got a couple of these this morning:

snort[11083]: [129:5:1] Bad segment, adjusted size <= 0

Now...I have been reading the README.stream5 doc, but the only item I see
that could apply to this is SID 5 Bad segment, overlap adjusted size less
than/equal 0.

However, my stream5 has the overlap_limit 0 set.  Are these the same?  Does:

Bad segment, overlap adjusted size less than/equal 0 = Bad segment,
adjusted size <= 0?  Thank you.

James





More information about the Snort-users mailing list