Snort mailing list archives

spp_stream4: TTL EVASION (reassemble) detection

From: "Pedro Tedeschi" <pedro.tedeschi () frb-par com>
Date: Fri, 20 Sep 2002 11:31:50 -0300

Hi, whats means this rule? 
"spp_stream4: TTL EVASION (reassemble) detection"

I didn't find  this one in the rules path, and i'm recieve more than 56000 attacks about this rule ...

Is this rule are important? If not, i would like to know, how i can remove this rule ...


Thanks in advance


Cheers,

Pedro Tedeschi

Current thread:

Spanning port jai (Sep 20)
- spp_stream4: TTL EVASION (reassemble) detection Pedro Tedeschi (Sep 20)
- Re: Spanning port quentyn (Sep 20)
  - Re: Spanning port jai (Sep 20)
    - RE: Spanning port Wayne T Work (Sep 21)
    - Re: Spanning port twig les (Sep 21)
- <Possible follow-ups>
- RE: Spanning port McCammon, Keith (Sep 20)
- RE: Spanning port Uhte, Russ (Sep 20)