Selectively disabling some stream4 alerts

["Kevin M. Myer" <kevin_myer () iu13 k12 pa us>]

Hi,

I'm running snort 1.8p1 on Linux with the stream4 preprocessor.  I am
getting inundated with "spp_stream4: Possible RETRANSMISSION detection"
alerts (approximately 180,000 out of 195,000 alerts are of that type).
Since a retransmission is a normal part of a network stream, I'm not all
that concerned about it (unless this is some different sort of
transmission).  However, it seems that with the alerts, its all or nothing
and I'd really like to see the other alerts the stream4 preprocessor kicks
out.

Is there any way to do this short of modifying the source code?

Thanks,
Kevin
-- 
Kevin M. Myer
Systems Administrator
Lancaster-Lebanon Intermediate Unit 13
(717)-560-6140



_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users