Re: [Snort-devel] 'established' with Snort 2.x on openbsd

Jon Hart <warchild@spoofed.org> writes:

> So, I'm either going to hack xl(4) to disable the checksums or just swap

You can also turn off checksumming for snort. Even nicer would be to modify to do that for only particular IPs ( since normally only 1 machine in your network is having that problem when it's the source of the traffic.

If you are only doing read back analysis, netdude (netdude.sf.net) contains a plugin that will fix checksums that works quite well. Heck, if if you don't want to do that, that project deserves a periodic plug.

-- 
Chris Green 
Chicken's thinkin'



-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.
http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
_______________________________________________
Snort-devel mailing list
Snort-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-devel