Snort mailing list archives
Re: [Snort-devel] dsize broken in snort 2 (and possibly 1.9.x)
From: Chris Green <cmg () snort org>
Date: Tue, 29 Oct 2002 15:52:13 -0500
"Kreimendahl, Chad J" <Chad.Kreimendahl () umb com> writes:
It appears that in at least v2 of snort that dsize is not working for any rule that uses it. Anyone else experienced this?
dsize should not be used for things coming out of the stream reassembler and the sig set needs to be audited for things that rely on it. Do you have an example packet that you are expecting to see go off? -- Chris Green <cmg () sourcefire com> This is my signature. There are many like it but this one is mine. ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- dsize broken in snort 2 (and possibly 1.9.x) Kreimendahl, Chad J (Oct 29)
- Re: [Snort-devel] dsize broken in snort 2 (and possibly 1.9.x) Chris Green (Oct 29)