Snort mailing list archives
Re: uricontent error
From: Jason Haar <Jason.Haar () trimble co nz>
Date: Thu, 15 Sep 2005 18:28:09 +1200
Joel Esler wrote:
Uricontent by default will only read 300 bytes into a packet. (you can configure this, but I recommend not)Since uricontent is really only good at the beginning of a session, it's really handy for a initial GET request.
How does it handle HTTP/1.1 transactions? i.e. where a single TCP stream might contain 10-12 GET requests?
Actually - I think I see my answer in decode.h - max of 5 requests per HTTP connection?
-- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 ------------------------------------------------------- SF.Net email is sponsored by: Tame your development challenges with Apache's Geronimo App Server. Download it for free - -and be entered to win a 42" plasma tv or your very own Sony(tm)PSP. Click here to play: http://sourceforge.net/geronimo.php _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- uricontent error Dario Alonso (Sep 14)
- Re: uricontent error Joel Esler (Sep 14)
- Re: uricontent error Jason Haar (Sep 14)
- Re: uricontent error Russ Starr (Sep 14)
- Re: uricontent error Joel Esler (Sep 14)