Snort mailing list archives
Re: [Snort-devel] snort stateful inspection testing
From: Andrea Barisani <lcars () infis univ trieste it>
Date: Mon, 18 Mar 2002 08:29:47 +0100
On Mon, Mar 18, 2002 at 10:47:32AM +0530, Gangadhar NPK wrote:
the -z est option works on established connections..so thats the reason, probably is that once the connection is established snort is not lookin at the packets.correct me if i am wrong
I think that snort is not looking at packets that are NOT part of an established connection.
regards gangadhar
Bye ------------------------------------------------------------ INFIS Network Administrator & Security Officer .*. Department of Physics - University of Trieste /V\ lcars () infis univ trieste it - PGP Key 0x8E21FE82 (/ \) ---------------------------------------------------- ( ) "How would you know I'm mad?" said Alice. ^^-^^ "You must be,'said the Cat,'or you wouldn't have come here." ------------------------------------------------------------ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- snort stateful inspection testing Andrea Barisani (Mar 16)
- Ignore portscan from dynamic IP Dan McIntosh (Mar 16)
- Message not available
- Re: [Snort-devel] snort stateful inspection testing Andrea Barisani (Mar 17)
- Re: [Snort-devel] snort stateful inspection testing Michael Scheidell (Mar 21)
- Re: [Snort-devel] snort stateful inspection testing Andrea Barisani (Mar 17)