spp_stream4: TTL EVASION (reassemble)

["Jonathan Baker" <jb () hmco com>]

Hi,

I have been told that in order to disable these alerts I should set
ttl_limit to 0, but I am not sure in what file this should be set.  I tried
setting it in the snort.conf file as listed here "preprocessor stream4:
detect_scans, disable_evasion_alerts, timeout 0" but that seems not to have
worked.  Can anyone help?

I'm running snort 1.8.7.

Thanks,
jb



-------------------------------------------------------
This sf.net email is sponsored by: OSDN - Tired of that same old
cell phone?  Get a new here for FREE!
https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users