Snort mailing list archives
Re: Content string search across packets
From: Matt Kettler <mkettler () evi-inc com>
Date: Thu, 29 Apr 2004 19:27:12 -0400
At 04:39 PM 4/29/2004, sowdambiga karthikeyan wrote:
I have a general question about the content string search in snort. Does snortsupport searching for a string across multiple packets. For eg. can we searchfor a string "ABCDEF" where "ABC" is present in one packet and "DEF" is presentin the next packet.
Depends on what kind of packet you're talking about.If it's TCP, and no actual data is sent back by the other end in between, then in general stream4 should cover you there with no special effort. Stream4 will re-assemble packets of a TCP stream up into hunks and run them down at least 2 packets at a time, and more than 2 at a time if the packets are small.
With tcp you run into trouble when people try do do things like look for "abc" and then try to find "def" 20k later in the data stream. Stream4 doesn't work in such a way that you can search an entire tcp session as if it were one gigantic packet, you're pretty much limited to about 3k of data at most.
If you're talking udp packets, or there's some kind of acknowledgement in between, then you'll need to use tagging to allow you to chain two separate rules together to generate an alert.
------------------------------------------------------- This SF.Net email is sponsored by: Oracle 10gGet certified on the hottest thing ever to hit the market... Oracle 10g. Take an Oracle 10g class now, and we'll give you the exam FREE. http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Content string search across packets sowdambiga karthikeyan (Apr 29)
- Re: Content string search across packets Matt Kettler (Apr 29)