Very high amount of "TCP Small Segment Threshold Exceeded"

[Giacomo <lib.giacomo () gmail com>]

Hi there,

I recently started using Snort. After enabling the (default) preprocessor configuration I started receiving very large 
amounts of events regarding stream5.
Since it is a server that is not being used for anything I assume this event is generated by my SSH connection. A 
couple of topics have discussed this but none come with a very clear answer why this is occurring and how you can solve 
it.
The only two suggestions I found was to change the max_tcp value in stream5_global or increase the memcap. But both of 
these suggestions don't work. So I am wondering if any one of you has an idea why this is occurring and what I can do 
about it.

Thanks. 
------------------------------------------------------------------------------
Keep Your Developer Skills Current with LearnDevNow!
The most comprehensive online learning library for Microsoft developers
is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3,
Metro Style Apps, more. Free future releases when you subscribe now!
http://p.sf.net/sfu/learndevnow-d2d
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!