Re: Tagged Packet ... AAAHHH

[Dirk Geschke <dirk () geschke-online de>]

Hi Michael,

> I believe I have suppressed alerts for "Tagged Packet" as I do not see 
> them in the alert file, however. In the web GUI provided by BASE I can 
> see that "Tagged Packet" appears to be logged still.
>
> I must be misunderstanding something here, can anyone help me out ?

I think this are reassembled packets from stream4. If you use the
unified output plugin these packets are split to the original size.
The first packet carries the alert informations, the others are marked
as tagged packets.

Best regards

Dirk


-------------------------------------------------------
This SF.Net email is sponsored by the JBoss Inc.
Get Certified Today * Register for a JBoss Training Course
Free Certification Exam for All Training Attendees Through End of 2005
Visit http://www.jboss.com/services/certification for more information
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users