Snort mailing list archives
Re: snort mixes multiple (unrelated) payloads into one alert
From: Jason Brvenik <jasonb () sourcefire com>
Date: Mon, 24 Jul 2006 13:21:25 -0400
Eric J. Bowser wrote:
Jason wrote:The problem is packet loss. A single buffer is used for reassembly. If you are missing packets when reassembly is done then the old data is still in the gaps...So to make sure I have this right... mixed data happens when there is packet loss. Turning on "zero_flushed_packets" will prevent the mixing, causing me to see all 0x00 instead. If running "zero_flushed_packets" has a performance hit associated, won't it increase incidence of dropped packets, and make the reassembly problem even worse?
yup. the proper solution is to appropriately size and tune the system to handle the traffic. zero_flushed_packets really only solves the erroneous event problems.
Thanks for the info so far guys, keep it coming =) ~Eric ------------------------------------------------------------------------ ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys -- and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV ------------------------------------------------------------------------ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys -- and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- snort mixes multiple (unrelated) payloads into one alert Eric J. Bowser (Jul 21)
- Re: snort mixes multiple (unrelated) payloads into one alert Gentoo-Wally (Jul 21)
- Re: snort mixes multiple (unrelated) payloads into one alert nikns (Jul 21)
- Re: snort mixes multiple (unrelated) payloads into one alert Frank Knobbe (Jul 21)
- Re: snort mixes multiple (unrelated) payloads into one alert Jason (Jul 23)
- Re: snort mixes multiple (unrelated) payloads into one alert Jason Haar (Jul 23)
- Re: snort mixes multiple (unrelated) payloads into one alert Frank Knobbe (Jul 24)
- Re: snort mixes multiple (unrelated) payloads into one alert Jason Brvenik (Jul 24)
- Re: snort mixes multiple (unrelated) payloads into one alert Martin Roesch (Jul 24)
- Re: snort mixes multiple (unrelated) payloads into one alert Eric J. Bowser (Jul 24)
- Re: snort mixes multiple (unrelated) payloads into one alert Jason Brvenik (Jul 24)
- Re: snort mixes multiple (unrelated) payloads into one alert nikns (Jul 21)
- Re: snort mixes multiple (unrelated) payloads into one alert Gentoo-Wally (Jul 21)