Re: [Snort-sigs] new Q signature

On Mon, Feb 10, 2003 at 05:50:01PM -0500, Jason wrote:
> ttl_limit defines the acceptable ttl variance for a given session.

OK, I guess I was a bit confused based on some of the Snort documentation and the message that stream4 emits. Anyway, thanks for that clarification.

Of all the TTL warnings that stream4 has given me, all of them have been suspicious.

Would anyone else be willing to run my tag rule posted earlier? That might help get to the bottom of this Q traffic.

-jon Received on Mon Feb 10 20:47:11 2003