Re: snort_decoder

[Joel Esler <eslerj () gmail com>]

No, they are decoder "errors" telling you that a packet that has "tcp  
options" "with bad lengths" has been found and that (maybe another  
packet) that the tcp options have been truncated.

Most people I know shut these off.

You can find out to shut these off in the snort.conf or in the snort  
manual.

joel


On Jul 17, 2005, at 4:17 PM, Angelita de Cássia Corrêa wrote:

> Do these alerts mean false positives?
>
> (snort_decoder): Tcp Options found with bad lengths
> (snort_decoder): Truncated Tcp Options
>
>
> Thanks