Snort mailing list archives
Emergency Ports
From: Martin Olsson <elof () sentor se>
Date: Thu, 12 Jan 2006 10:49:50 +0100 (CET)
What is "Emergency Ports" found in stream4_reassemble and when/how are they used? The "emergency ports" seem to be the default portlist, containing other ports than the ones I have specified with the "reassemble ports" directive... Example: Stream4_reassemble config: Server reassembly: ACTIVE Client reassembly: ACTIVE Reassembler alerts: ACTIVE Zero out flushed packets: INACTIVE Flush stream on alert: INACTIVE flush_data_diff_size: 500 Reassembler Packet Preferance : Favor Old Packet Sequence Overlap Limit: -1 Flush behavior: random Flush base: 512 Flush seed: 1137077499 Flush range: 1213 Ports: 20 21 23 25 53 80 110 111 143 513 1433 1521 3306 5432 6666 6667 8080 Emergency Ports: 21 23 25 42 53 80 110 111 135 136 137 139 143 445 513 1433 1521 3306 /Martin ------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Do you grep through log files for problems? Stop! Download the new AJAX search engine that makes searching your log files as easy as surfing the web. DOWNLOAD SPLUNK! http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Emergency Ports Martin Olsson (Jan 12)
- Re: Emergency Ports Matthew Watchinski (Jan 12)