spp_stream4 possible EVASIVE RST

["KD Rajkumar" <koderma () hotmail com>]

What would cause Snort to generate the following message:

Apr 14 15:58:31 testbox.test.com snort: [111:2:1] (spp_stream4) possible 
EVASIVE RST detection {TCP} 192.168.128.200:35800 -> 192.168.64.115:4031

It's happened a few times today. The testbox in question has recently been 
re-IPed.

I am running Snort 1.9 on RHL 7.3. Also, where should I look to see what is 
causing the pre-processor to alert on this packet ?

Thanks.

_________________________________________________________________
The new MSN 8: smart spam protection and 2 months FREE*  
http://join.msn.com/?page=features/junkmail



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users