VRT stream5 Preprocessor Config vs Default Settings

[Eoin Miller <eoin.miller () trojanedbinaries com>]

VRT supplied snort.conf file that comes with 2.9.0.4 as of today 
contains this line:

---snip---
preprocessor stream5_global: max_tcp 8192, track_tcp yes, track_udp yes, 
track_icmp no max_active_responses 2 min_response_seconds 5
^ ^
|---missing commas?----|
---snip---

I guess it still loads it with these options? If not it should look like 
(separated by line to make easier to read in the email threads):

preprocessor stream5_global: max_tcp 8192,\
track_tcp yes,\
track_udp yes,\
track_icmp no,\
max_active_responses 2,\
min_response_seconds 5

Some of those settings are even less than what is turned on by default 
though it would appear. max_tcp is set to 8192 in the VRT conf as shown 
above, however the 2.9.0.5 manual states:
--snip--
max_tcp <num sessions> || Maximum simultaneous TCP sessions tracked. The 
default is ”262144”, maximum is ”1048576”, minimum is ”1”.
--snip--

What else is weird is that max_udp is missing in the config and therefor 
the default value of 131072 would kick in, so the VRT config has you 
tracking a lot more UDP sessions that TCP sessions with stream5. From 
the 2.9.0.5 manual:
--snip--
max_udp <num sessions> || Maximum simultaneous UDP sessions tracked. The 
default is ”131072”, maximum is ”1048576”, minimum is ”1”.
--snip--

Not sure if this is by design or just an artifact from the previous 
snort.conf's where this has been set to this value forever in recent 
memory. Value does seem pretty low however.


I guess something more like:

preprocessor stream5_global: track_tcp yes,\
track_udp yes,\
track_icmp no,\
max_active_responses 2,\
min_response_seconds 5

Or:

preprocessor stream5_global: track_tcp yes,\
max_tcp 262144,\
track_udp yes,\
max_udp 131072,\
track_icmp no,\
max_active_responses 2,\
min_response_seconds 5

Thought this might be worthy of review/consideration for others.

-- Eoin



------------------------------------------------------------------------------
WhatsUp Gold - Download Free Network Management Software
The most intuitive, comprehensive, and cost-effective network 
management toolset available today.  Delivers lowest initial 
acquisition cost and overall TCO of any competing solution.
http://p.sf.net/sfu/whatsupgold-sd
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users