New answers tagged snort
Stream. Here is a good document regarding how snort uses libpcap to apply heuristic and signature based anomoly detection to network traffic; http://www.pearsonhighered.com/samplechapter/157870281X.pdf and when in doubt consult the manual https://www.snort.org/faq/readme-stream5
Changing the checksum_mode to none in the snort.conf file (config checksum_mode: none) solves the problem and I can now see alerts for the relay rule in my log file.
Top 50 recent answers are included