Re: Stream5 confusion

["Eric L. Howard" <ericlhoward () gmail com>]

On Tue, Dec 28, 2010 at 1:32 PM, Lay, James <james.lay () wincofoods com> wrote:
> Hey Team,
>
> So...I'm doing my upgrade to 2.9.0.3, a perfect time to audit my .conf
> files.  Maybe I'm over thinking, but I think I'm confused on the
> reasons/differences for stream5 ports client/server/both.

in ports <client|server|both> - the directives indicate from which
side of the connection you would like to have stream5 reassemble the
packets.

> The default config has things like:
>
>                ports client 21 22 23 ...

This says to reassemble packets from the client side where dst_port is
21, 22, 23. TCP/21, 22, 23 is the server port and Snort reassembles
the client side in this config directive

>                ports both 80 311 443 ...

This then means to reassemble packets from both sides of the
connection where the dst_port is 80, 211, 443, etc...

> Pretending that we don't have ftp, http, and telnet preprocessors,
> wouldn't one want to put things like 21, 22, and 23 in as both or
> server?  As I understand it, this is how it works, with port 80 as an
> example:
>
>                ports server 80, reassemble any local -> remote port 80
>
>                ports client 80, reassemble local port 80 -> any remote
> port
>
>                ports both 80, reassemble local port 80 -> any remote
> port or local port 80 -> any remote port

Hope the above helps...

~elh

------------------------------------------------------------------------------
Learn how Oracle Real Application Clusters (RAC) One Node allows customers
to consolidate database storage, standardize their database environment, and, 
should the need arise, upgrade to a full multi-node Oracle RAC database 
without downtime or disruption
http://p.sf.net/sfu/oracle-sfdevnl
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users