Snort mailing list archives

how to disable "Short UDP packet, length field" alert?


From: "sb ch" <chulmin22 () hotmail com>
Date: Mon, 16 Jun 2003 11:30:20 +0900

Hello, all.

I would like to disable this function, but I can't find any rule file related.
So this alert has nothing related rule files.
How can I disable this logging?
Surely, I did like below, but alerts are continued.

var HOME_NET any ![210.xx.xx.xxx]
var EXTERNAL_NET any ![210.xx.xx.xxx]

[**] [116:97:1] (snort_decoder): Short UDP packet, length field > payload length [**]
06/16-11:16:14.651421 210.xx.xx.xxx:0 -> xxx.xxx.145.78:0
UDP TTL:254 TOS:0x0 ID:40445 IpLen:20 DgmLen:2596
Len: 2568


Thanks in advance.

_________________________________________________________________
도처에 도사리는 재해의 위험들. AIG의 무료보험으로 해결하세요. http://www.msn.co.kr/webinclude/exredir.asp?STARTID=CLIP_5644&adgroup=KRMGEN&URL=http://msn.aigis.co.kr/weekly_msn/main.asp



-------------------------------------------------------
This SF.NET email is sponsored by: eBay
Great deals on office technology -- on eBay now! Click here:
http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


Current thread: