Re: excessive numbers of Possible RETRANSMISSION detected

[diphen () agitation net]

This is how I have it configured in my snort.conf:

preprocessor stream4_reassemble: both,noalerts,ports default

I'm running snort 1.8p1 from snort.org.

-g

On Wed, Aug 01, 2001 at 04:12:14PM -0500, Chris Green wrote:
> What version of snort are you using?  in the latest snort cvs they are
> off by default.  If you look at the options in the default snort.conf,
> there are ways to turn of "internal to spp4" alerts.
>
> preprocessor stream4: noalerts
>
> should do it for snort 1.8
>
> It will be off by default in 1.8.1
> -- 
> Chris Green <cmg () uab edu>
> A watched process never cores.

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users