[Snort-inline-users] Answer to a previously asked question

[William M. <Wil...@kc...>]

Looking through my past e-mails, I missed a question that Ben Jsh asked,
which was how to run snort_inline in stateless mode.  If you use the
default patch, you are running stateless mode.  If you are running your own
.conf file comment out:


preprocessor stream4: disable_evasion_alerts
preprocessor stream4_reassemble

In addition you should probably comment out anything that has to do with
flow and frag2

Regards,

Will