Snort mailing list archives
how to disable "Short UDP packet, length field" alert?
From: "sb ch" <chulmin22 () hotmail com>
Date: Mon, 16 Jun 2003 11:30:20 +0900
Hello, all.I would like to disable this function, but I can't find any rule file related.
So this alert has nothing related rule files. How can I disable this logging? Surely, I did like below, but alerts are continued. var HOME_NET any ![210.xx.xx.xxx]var EXTERNAL_NET any ![210.xx.xx.xxx]
[**] [116:97:1] (snort_decoder): Short UDP packet, length field > payload length [**]
06/16-11:16:14.651421 210.xx.xx.xxx:0 -> xxx.xxx.145.78:0 UDP TTL:254 TOS:0x0 ID:40445 IpLen:20 DgmLen:2596 Len: 2568 Thanks in advance. _________________________________________________________________도처에 도사리는 재해의 위험들. AIG의 무료보험으로 해결하세요. http://www.msn.co.kr/webinclude/exredir.asp?STARTID=CLIP_5644&adgroup=KRMGEN&URL=http://msn.aigis.co.kr/weekly_msn/main.asp
------------------------------------------------------- This SF.NET email is sponsored by: eBay Great deals on office technology -- on eBay now! Click here: http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- how to disable "Short UDP packet, length field" alert? sb ch (Jun 15)
- Re: how to disable "Short UDP packet, length field" alert? Erek Adams (Jun 16)