Home page logo

snort logo Snort mailing list archives

Re: TCP session without 3-way handshake - Snort
From: waldo kitty <wkitty42 () windstream net>
Date: Thu, 16 May 2013 14:36:25 -0400

On 5/16/2013 00:07, Russ Combs wrote:
129:20 is generated when you configure stream5_tcp with require_3whs
and detect_anomalies and you get traffic for a session without first
seeing the client SYN.  require_3whs is configured with a startup
delay before this rule will fire.  If you don't want those alerts, you
can remove require_3whs or disable the rule.

is it possible that snort not seeing the initial SYN packet is caused by snort 
having dropped packets for some reason?

what would be the best and easiest way to determine this?

NOTE: No off-list assistance is given without prior approval.
       Please keep mailing list traffic on the list unless
       private contact is specifically requested and granted.

AlienVault Unified Security Management (USM) platform delivers complete
security visibility with the essential security capabilities. Easily and
efficiently configure, manage, and operate all of your security controls
from a single console and one unified framework. Download a free trial.
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

Please visit http://blog.snort.org to stay current on all the latest Snort news!

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]