RE: spp_stream4: TTL EVASION (reassemble) detection

["McCammon, Keith" <Keith.McCammon () eadvancemed com>]

Read your comments in snort.conf: 
 
disable_evasion_alerts - turn off the possibly noisy mitigation of overlapping sequences.
 
You can uncomment this in the stream4 options.

-----Original Message-----
From: Pedro Tedeschi [mailto:pedro.tedeschi () frb-par com]
Sent: Friday, September 20, 2002 10:32 AM
To: snort-users () lists sourceforge net
Subject: [Snort-users] spp_stream4: TTL EVASION (reassemble) detection


Hi, whats means this rule? 
"spp_stream4: TTL EVASION (reassemble) detection"
 
I didn't find  this one in the rules path, and i'm recieve more than 56000 attacks about this rule ...
 
Is this rule are important? If not, i would like to know, how i can remove this rule ...
 
 
Thanks in advance
 
 
Cheers,
 
Pedro Tedeschi