spp_stream4

[Jason Gauthier <jgauthier () lastar com>]

I have started snort up, and am fine tuning my rules. I'm getting this
message ALOT.
It comes from the same system everytime.  My transparent web proxy.

I'm not really understanding what's going on. I'm guessing that this is the
stream4 preprocessor and the message is coming up because it's transparently
sending it to another box.

My question then, since this is a "false positive", is what can I do about
ignoring it?


Thanks kindly,

Jason


======================
Message:
spp_stream4: TCP CHECKSUM CHANGED ON RETRANSMISSION (possible fragroute)
detection


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Stuff, things, and much much more.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users