Re: [Snort-sigs] new Q signature

Jon wrote:

>On Tue, Feb 11, 2003 at 08:17:14AM +1100, Hall, Andrew (DPRS) wrote:

ttl_limit defines the acceptable ttl variance for a given session. so in english, if a ttl changes more than ttl_limit in a given session then you will get an alert.

if you have asymetric routes or the upstream or the endpoint or you have dynamic load balancing... you can see a bunch of these.

either increase the limit to be more appropriate for the environment or disable it by setting it to 0

>
>Thanks,
>
>-jon
>
>
>
Received on Mon Feb 10 20:46:20 2003