<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
We’re going to need some more info here:
<div class=""><br class="">
</div>
<div class=""><a href="https://snort.org/faq/how-do-i-ask-a-good-question-on-the-snort-list" class="">https://snort.org/faq/how-do-i-ask-a-good-question-on-the-snort-list</a></div>
<div class=""><br class="">
</div>
<div class=""><br class="">
<div class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div class=""><b style="font-family: Calibri, sans-serif; font-size: 10px;" class=""><font color="#5e5e5e" class="">--</font></b></div>
<div style="font-size: 14px;" class=""><b style="font-family: Calibri, sans-serif; font-size: 12px;" class=""><font color="#5e5e5e" class="">Joel Esler </font></b><span style="font-family: Calibri, sans-serif; font-size: 12px;" class="">| </span><b style="font-family: Calibri, sans-serif; font-size: 12px;" class=""><font color="#0096ff" class="">Talos:</font></b><span style="font-family: Calibri, sans-serif; font-size: 12px;" class=""> M</span><font color="#424242" style="font-family: Calibri, sans-serif; font-size: 12px;" class="">anager
 | <a href="mailto:jesler@...589..." class="">jesler@...589...</a></font></div>
<div class=""><font color="#424242" style="font-family: Calibri, sans-serif; font-size: 10px;" class=""><br class="">
</font></div>
</div>
<br class="Apple-interchange-newline">
</div>
<br class="Apple-interchange-newline">
</div>
<br class="Apple-interchange-newline">
<br class="Apple-interchange-newline">
</div>
<br class="">
<div style="">
<blockquote type="cite" class="">
<div class="">On Dec 21, 2016, at 12:19 PM, Nouar Ismail <<a href="mailto:nouaresmail@...11827..." class="">nouaresmail@...11827...</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div dir="ltr" class=""><span style="font-size:12.800000190734863px" class="">Hello</span>
<div style="font-size:12.800000190734863px" class="">I have pcap file of 450 icmp fragmented packets.</div>
<div style="font-size:12.800000190734863px" class="">when i pass it to snort with only icmp rules ..i get no alerts. when i add an ip rule i get exactly 450 alerts.</div>
<div style="font-size:12.800000190734863px" class="">i set up the frag3_global: memcap 67108864, max_frags 131072</div>
<div style="font-size:12.800000190734863px" class="">frag3_engine: : policy last detect_anomalies<br class="">
</div>
<div style="font-size:12.800000190734863px" class="">does anybody have any idea of what is the problem ?!</div>
<div style="font-size:12.800000190734863px" class="">#frag3_global </div>
</div>
------------------------------------------------------------------------------<br class="">
Developer Access Program for Intel Xeon Phi Processors<br class="">
Access to Intel Xeon Phi processor-based developer platforms.<br class="">
With one year of Intel Parallel Studio XE.<br class="">
Training and support from Colfax.<br class="">
Order your platform today.<a href="http://sdm.link/intel_______________________________________________" class="">http://sdm.link/intel_______________________________________________</a><br class="">
Snort-users mailing list<br class="">
<a href="mailto:Snort-users@lists.sourceforge.net" class="">Snort-users@lists.sourceforge.net</a><br class="">
Go to this URL to change user options or unsubscribe:<br class="">
https://lists.sourceforge.net/lists/listinfo/snort-users<br class="">
Snort-users list archive:<br class="">
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users<br class="">
<br class="">
Please visit http://blog.snort.org to stay current on all the latest Snort news!</div>
</blockquote>
</div>
<br class="">
</div>
</body>
</html>