Snort mailing list archives
(spp_stream4) TTL LIMIT Exceeded
From: John Hally <JHally () epnet com>
Date: Fri, 18 Apr 2003 09:19:56 -0400
Hello, Need a little help here, as I'm not to well versed in the spp_stream4 preprocessor. Why would I be getting alerted to the below, even though the trace looks legitimate, and the TTL value in the trace is 3? thanks -----Original Message----- From: ACID Alert [mailto:acid () acidconsole epnet com] Sent: Friday, April 18, 2003 9:15 AM To: jhally () epnet com Subject: ACID Incident Report Generated by ACID v0.9.6b22 on Fri, 18 Apr 2003 09:15:26 -0400 #9-16506| [2003-04-18 08:44:32] 202.114.71.171:38028 -> xxx.xxx.xxx.33:80 [snort/15] (spp_stream4) TTL LIMIT Exceeded ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- (spp_stream4) TTL LIMIT Exceeded John Hally (Apr 18)