Re: Selectively disabling some stream4 alerts

[Erek Adams <erek () theadamsfamily net>]

On Thu, 9 Aug 2001, Kevin M. Myer wrote:

> I'm running snort 1.8p1 on Linux with the stream4 preprocessor.  I am
> getting inundated with "spp_stream4: Possible RETRANSMISSION detection"
> alerts (approximately 180,000 out of 195,000 alerts are of that type).
> Since a retransmission is a normal part of a network stream, I'm not all
> that concerned about it (unless this is some different sort of
> transmission).  However, it seems that with the alerts, its all or nothing
> and I'd really like to see the other alerts the stream4 preprocessor kicks
> out.

Stream4 is a nosiy lil bugger.  I think Marty did it to get ready for his
having a child!  ;-)

> Is there any way to do this short of modifying the source code?

Yep.  Update. :)  Grab the nightly CVS tarball from:

http://snort.sourceforge.net/snort-daily.tar.gz

Many, Many updates and changes since your version.

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users