Snort mailing list archives
Re: stream4's new config
From: zhaohui yin <yinzhaohui () gmail com>
Date: Fri, 18 Nov 2005 13:48:34 +0800
thanks for your explain. to the rcved packet which is considered as unestablished, we will sdrop it whenever we config the midstream_drop_alerts. enable midstream_drop_alerts will triger alert in such situation. is this understand true? On 11/18/05, Will Metcalf <william.metcalf () gmail com> wrote:
The midstream_drop_alerts is for the inline feature set, basically what happens is when you drop a packet, the client retransmits the dropped packet over and over again because it believes that the packet was lost in transit. During the retransmission the stream4 session may timeout so while in InlineMode we still need to inspect data on sessions stream4 considers unestablished. The default behavior is to sdrop these alerts. by enabling midstream_drop_alerts you would see these midstream alerts. Think of it as cheap protection against snot/stick attacks for InlineMode(). Regards, Will On 11/17/05, zhaohui yin <yinzhaohui () gmail com> wrote:while i read the snort source, I found some new config the stream4 preprocessor had support ,but those config can't find any description in the manual. preprocessor stream4:midstream_drop_alerts preprocessor stream4_reassemble: flush_behavior < default| random | large_window >,flush_seed <seed>,flush_base <base>,flush_range <range> who can tell the above config's means. -- yinzhaohui ------------------------------------------------------- This SF.Net email is sponsored by the JBoss Inc. Get Certified Today Register for a JBoss Training Course. Free Certification Exam for All Training Attendees Through End of 2005. For more info visit: http://ads.osdn.com/?ad_idv28&alloc_id845&opclick _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?listsnort-users
-- yinzhaohui ------------------------------------------------------- This SF.Net email is sponsored by the JBoss Inc. Get Certified Today Register for a JBoss Training Course. Free Certification Exam for All Training Attendees Through End of 2005. For more info visit: http://ads.osdn.com/?ad_idv28&alloc_id845&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- stream4's new config zhaohui yin (Nov 17)
- Re: stream4's new config Will Metcalf (Nov 17)
- Re: stream4's new config zhaohui yin (Nov 17)
- Re: stream4's new config Jason Brvenik (Nov 18)
- Re: stream4's new config Will Metcalf (Nov 17)