Re: snort decoder

[Chris Green <cmg () sourcefire com>]

jeremy chartier <jeremy.chartier () free fr> writes:

> Hi,
>
> I have a lot of this logs and I don't know what there arent mean :
>
> Mar 28 12:06:55 172.17.0.156/172.17.0.156 snort: [116:56:1]
> (snort_decoder): T/TCP Detected {TCP} 193.78.32.2:0 -> 195.46.206.25:0
>
> Thanks

Please include a packet capture with this from either snort -b mode or
tcpdump -s 65535

It means that it detected T/TCP TCP options

Uncomment the

# config: disable_ttcp_alerts

if you wish to quit alerting on these events.
-- 
Chris Green <cmg () sourcefire com>
"Yeah, but you're taking the universe out of context."


-------------------------------------------------------
This SF.net email is sponsored by:
The Definitive IT and Networking Event. Be There!
NetWorld+Interop Las Vegas 2003 -- Register today!
http://ads.sourceforge.net/cgi-bin/redirect.pl?keyn0001en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users