Snort mailing list archives
Re: What is the relationship between flow: and stream4_reassemble?
From: Brian Caswell <bmc () snort org>
Date: Sun, 9 Jan 2005 10:25:03 -0500
On Jan 8, 2005, at 6:14 PM, Jason Haar wrote:
e.g. does it mean that if you have a rule that needs to look for content that may cross a packet boundary, then it will fail unless that port is listed in stream4_reassemble?
yes. Brian ------------------------------------------------------- The SF.Net email is sponsored by: Beat the post-holiday blues Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek. It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- What is the relationship between flow: and stream4_reassemble? Jason Haar (Jan 07)
- Re: What is the relationship between flow: and stream4_reassemble? Brian Caswell (Jan 08)
- Re: What is the relationship between flow: and stream4_reassemble? Jason Haar (Jan 08)
- Re: What is the relationship between flow: and stream4_reassemble? Brian Caswell (Jan 09)
- Re: What is the relationship between flow: and stream4_reassemble? Jason Haar (Jan 09)
- Re: What is the relationship between flow: and stream4_reassemble? Jason Haar (Jan 08)
- Re: What is the relationship between flow: and stream4_reassemble? Brian Caswell (Jan 08)
- <Possible follow-ups>
- Re: What is the relationship between flow: and stream4_reassemble? M. Shirk (Jan 10)