Snort log alert is not the same as the live alerts.

["vmlinuz Mandrake" <vmlinuz () hotmail com>]

Dear All,

I am running Snort 2.0.0 build 72 on OpenBSD 3.3.  The snort is configured 
to dump the alerts to a tcpdump file.  During live output to console, it 
states that there are 34 alerts and therefore 34 packets were wrote into the 
file.  When i replay the tcpdump file, it informed me the alerts are lesser 
than 34.  After some test, i discovered that when i disable the stream4 and 
stream4_reassembly, i will get the same number of alerts .e.g. live alerts 
equals log alerts.

I am not sure why this happens, but would appreciate if someone could 
iluminate me what could be the possible cause of this.

The stream4 options set is detect_scans, disable_evasion_alerts.
stream4_reassemble is also enabled.

Regards.

_________________________________________________________________
Using a handphone prepaid card? Reload your credit online! 
http://www.msn.com.my/reloadredir/default.asp



-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users