Re: HTTP Inspect and packet reassembly

[Bhagya Bantwal <bbantwal () sourcefire com>]

On Thu, Oct 28, 2010 at 9:40 AM, L0rd Ch0de1m0rt
<l0rdch0de1m0rt () gmail com>wrote:

> Hello.  I am investigating a situation where TCP streams are being
> fragmented quite small at the IP layer for some reason (load
> balancer?) and it seems to be causing problems for some of my rules
> that leverage HTTP Inspect.  From the manual I read this:
>
> "The current version of HTTP Inspect only handles stateless
> processing. This means that HTTP Inspect looks for HTTP
> fields on a packet-by-packet basis, and will be fooled if packets are
> not reassembled. This works fine when there is
> another module handling the reassembly, but there are limitations in
> analyzing the protocol. Future versions will have
> a stateful processing mode which will hook into various reassembly
> modules."
>
> OK, so HTTP Inspect is stateless and doesn't reassemble packets.  But
> then there is the sentence, "This works fine when there is another
> module handling the reassembly, but there are limitations in analyzing
> the protocol."  So my question is, if I also have Stream5 enabled for
> TCP, is that a sufficient "another module" or are there still
> "limitations" with the HTTP protocol?

Yes. Stream5 reassembly is sufficient. It is suggested to turn on reassembly
on both HTTP server and client ports. Changes have been made to HTTP inspect
to inspect both stream inserted and reassembled packets.

-B

> Specifically, I have problems with rules that use uricontent and
> content and need to match across more than one packet.
>
> Thanks!
>
> -L0rd C.
>
>
> ------------------------------------------------------------------------------
> Nokia and AT&T present the 2010 Calling All Innovators-North America
> contest
> Create new apps & games for the Nokia N8 for consumers in  U.S. and Canada
> $10 million total in prizes - $4M cash, 500 devices, nearly $6M in
> marketing
> Develop with Nokia Qt SDK, Web Runtime, or Java and Publish to Ovi Store
> http://p.sf.net/sfu/nokia-dev2dev
> _______________________________________________
> Snort-devel mailing list
> Snort-devel () lists sourceforge net
> https://lists.sourceforge.net/lists/listinfo/snort-devel
------------------------------------------------------------------------------
Nokia and AT&T present the 2010 Calling All Innovators-North America contest
Create new apps & games for the Nokia N8 for consumers in  U.S. and Canada
$10 million total in prizes - $4M cash, 500 devices, nearly $6M in marketing
Develop with Nokia Qt SDK, Web Runtime, or Java and Publish to Ovi Store 
http://p.sf.net/sfu/nokia-dev2dev

_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel