Re: tag: Tagged Packet

[sekure <sekure () gmail com>]

Correct me if I am wrong, but I think if stream4 reassembles a stream
and triggers a rule, all the packets in the stream will get dumped
individually as tagged packets.

This may be why you are still seeing them.  I don't know how to
disable that (this doesn't mean there isn't a way) short of turning
off stream4 preprocessor, which isn't something you want to do.


On Fri, 7 Jan 2005 11:42:31 -0500 (ECT), Xavier Cabrera
<xavierc () devilcrack org> wrote:
> I have a little question:
>
> can any one know how can i stop to recieve tag: Tagged Packet , i erase
> all rules whit a tag parameter, and i still have recieving this alarms.
>
> I use snort 2.3RC1 and Barnyard 0.2.0
>
> Thanks
>
> Xavier Cabrera.
>
> -------------------------------------------------------
> The SF.Net email is sponsored by: Beat the post-holiday blues
> Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
> It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------
The SF.Net email is sponsored by: Beat the post-holiday blues
Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users