Lots of "spp_stream4: TTL EVASION (reasemble) "

["Augustinho Catto" <Catto () atlas unisinos br>]

Dear gurus:
Since I installed snort 1.87 version I received lots of alerts kind 
"spp_stream4: TTL EVASION (reassemble) detection ".
It happened in spite of fact I´ve already set:
"preprocessor stream4: disable_evasion_alerts" and
"preprocessor stream4_reassemble: noalerts" in snort.conf.
In this network exists a "Total Control" which receive dial-up 
connections.
How could avoid this false alerts?
TIA,
Catto


Augustinho Valmor CATTO
CNE - Analista de Suporte 
UNISINOS - Universidade do Vale do Rio dos Sinos
Sao Leopoldo - RS - Brasil
Phone: +55 xx 51 590-8386
http://www.unisinos.br/institucional/estrutura/
"From Brazil the land of FIFA worldwide soccer five times 
championship"





-------------------------------------------------------
This sf.net email is sponsored by: Jabber - The world's fastest growing 
real-time communications platform! Don't just IM. Build it in! 
http://www.jabber.com/osdn/xim
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users