Re: Strange Alerts

[Neil Dickey <neil () geol niu edu>]

Artur Bittencourt <artur () via-rs net> wrote asking:

>         I have the same situation here. After I´ve upgraded to Snort 2.0.0 
> I´ve got a lot of alerts (more than 191000) with "(snort_decoder): T/TCP 
> Detected" on my e-mail server. How do I turn this rule off ?

In your snort.conf file, look for this header ...

  # Configure the snort decoder:
  # ============================
  #

... and then under it:

  # Stop Alerts on T/TCP alerts:
  #
  # config disable_ttcp_alerts
  #

Uncomment the "disable" line, then re-start Snort.

Best regards,

Neil Dickey, Ph.D.
Research Associate/Sysop
Geology Department
Northern Illinois University
DeKalb, Illinois
60115




-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users