[Snort-users] Bad segment question
jlay at ...13475...
Mon Jun 14 13:43:02 EDT 2010
So I have a question...I got a couple of these this morning:
snort: [129:5:1] Bad segment, adjusted size <= 0
Now...I have been reading the README.stream5 doc, but the only item I see
that could apply to this is SID 5 Bad segment, overlap adjusted size less
However, my stream5 has the overlap_limit 0 set. Are these the same? Does:
Bad segment, overlap adjusted size less than/equal 0 = Bad segment,
adjusted size <= 0? Thank you.
More information about the Snort-users