Snort mailing list archives
Re: Selectively disabling some stream4 alerts
From: Erek Adams <erek () theadamsfamily net>
Date: Thu, 9 Aug 2001 10:04:18 -0700 (PDT)
On Thu, 9 Aug 2001, Kevin M. Myer wrote:
I'm running snort 1.8p1 on Linux with the stream4 preprocessor. I am getting inundated with "spp_stream4: Possible RETRANSMISSION detection" alerts (approximately 180,000 out of 195,000 alerts are of that type). Since a retransmission is a normal part of a network stream, I'm not all that concerned about it (unless this is some different sort of transmission). However, it seems that with the alerts, its all or nothing and I'd really like to see the other alerts the stream4 preprocessor kicks out.
Stream4 is a nosiy lil bugger. I think Marty did it to get ready for his having a child! ;-)
Is there any way to do this short of modifying the source code?
Yep. Update. :) Grab the nightly CVS tarball from: http://snort.sourceforge.net/snort-daily.tar.gz Many, Many updates and changes since your version. ----- Erek Adams Nifty-Type-Guy TheAdamsFamily.Net _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: http://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Selectively disabling some stream4 alerts Kevin M. Myer (Aug 09)
- Re: Selectively disabling some stream4 alerts Erek Adams (Aug 09)