RE: False Alerts

["Hicks, John" <JHicks () JUSTICE GC CA>]

preprocessor stream4: disable_evasion_alerts

hth,
John

-----Original Message-----
From: Sean T. Ballard [mailto:stballard () 4glschools com]
Sent: Wednesday, October 09, 2002 2:22 PM
To: snort-users () lists sourceforge net
Subject: [Snort-users] False Alerts


I keep getting thousands of "spp_stream4: possible EVASIVE RST detection"
alerts and cannot figure out how to disable them. I know there coming from
the stream4 pre proccessor. I am running snort 1.8.9, Demarc 1.6, and Redhat
7.3 


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users