RE: Fragmented RPC Records

["Cloppert, Michael" <Michael.Cloppert () 53 com>]

I've also been seeing this.  There was a lot of talk on the list regarding
this issue immediately after the 1.9.1 release, but I didn't see any
resolutions.  I've had to turn off RPC Decode in the interim.  I'd be
interested to hear from one of the developers on this one - is this a bug,
or was the previous version buggy?  Can we control this in any way?

Mike Cloppert

> -----Original Message-----
> From: Darrin Powell [mailto:dpowell () lssi net]
> Sent: Tuesday, March 25, 2003 11:43 AM
> To: snort-users () lists sourceforge net
> Subject: [Snort-users] Fragmented RPC Records 
>
>
> After I did the update to ver 1.9.1, I started getting a lot of false
> alarms for
>
> (spp_rpc_decode) Fragmented RPC Records   
>
> I could not find a rule to match this. Can someone tell me how to shut
> it off?
>
>
>
> Thanks in advance
> Darrin
>
>
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by:
> The Definitive IT and Networking Event. Be There!
> NetWorld+Interop Las Vegas 2003 -- Register today!
> http://ads.sourceforge.net/cgi-bin/redirect.pl?keyn0001en
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------
This SF.net email is sponsored by:
The Definitive IT and Networking Event. Be There!
NetWorld+Interop Las Vegas 2003 -- Register today!
http://ads.sourceforge.net/cgi-bin/redirect.pl?keyn0001en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users