Re: snort sees no fragmented attack

[Holger.Woehle () arcor net]

> echo "GET /aaaaaaa/aaa/aaaaa/aaaaaaaa/aaaaaaa/bcc/bin/ps" | nc

Hello,
i forgot to tell you some Version numbers :
I am using Snort 1.8.7 also tested it with 1.9 beta 2 and Linux 2.4.18 Intel
Pentium 4 2GHZ 256 MByte RAM.
The Sensor listens behind a Shomiti Ethernet TAP.
May this be the problem ?
The Sensor only catches the "incoming" traffic. I do not want the answers from
the machines.
Am i wrong with that ? Does snort neeed the outgoing traffic for defrag ?

cu
holger





-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users