[Snort-users] stream5 and http_inspect

Pratik Narang pratik.cse.bits at ...11827...
Wed Sep 5 09:49:38 EDT 2012


I am getting excessive number of stram5: TCP small segment threshold
exceeded, and http_inspect: long header alerts. I do not want to disable
these Preprocessors (stream5 is anyways needed for certain other
preprocessors). So what should I do? I guess preprocessors dont really have
a 'rule' which I can just comment so that it wont show up, right?

Thanks.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20120905/0d1841a0/attachment.html>


More information about the Snort-users mailing list