I guess if you have lots of packet losses there will be lots of http parse errs (and not only).... or you can try increasing the anomaly counters for example for http, if that is of concearn.<br><br>thanks<br><br><div class="gmail_quote">
On Wed, Jan 11, 2012 at 10:03 PM, Seth Hall <span dir="ltr"><<a href="mailto:seth@icir.org">seth@icir.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im"><br>
On Jan 11, 2012, at 2:20 PM, Victor Julien wrote:<br>
<br>
> I would be interested to hear experiences on busy networks with these<br>
> rules enabled!<br>
<br>
<br>
</div>How does this fare if you have packet loss during the session?<br>
<span class="HOEnZb"><font color="#888888"><br>
.Seth<br>
<br>
--<br>
Seth Hall<br>
International Computer Science Institute<br>
(Bro) because everyone has a network<br>
<a href="http://www.bro-ids.org/" target="_blank">http://www.bro-ids.org/</a><br>
</font></span><div class="HOEnZb"><div class="h5"><br>
_______________________________________________<br>
Oisf-users mailing list<br>
<a href="mailto:Oisf-users@openinfosecfoundation.org">Oisf-users@openinfosecfoundation.org</a><br>
<a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br>Peter Manev<br>