Re: excessive numbers of Possible RETRANSMISSION detected

[Chris Green <cmg () uab edu>]

diphen () agitation net writes:

> I'm not too familiar with spp_stream4, and I'm seeing tons of the
> following messages. Anybody have tips on how to tune/fix it to dispose
> of them? Thanks.

What version of snort are you using?  in the latest snort cvs they are
off by default.  If you look at the options in the default snort.conf,
there are ways to turn of "internal to spp4" alerts.

preprocessor stream4: noalerts

should do it for snort 1.8

It will be off by default in 1.8.1
-- 
Chris Green <cmg () uab edu>
A watched process never cores.

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users