Re: VRT stream5 Preprocessor Config vs Default Settings

[Joel Esler <jesler () sourcefire com>]

We've taken this for action on our side. Thanks Eoin. 

-- 
Sent from my iPad
Please excuse the brevity

On Apr 28, 2011, at 5:20 PM, Eoin Miller <eoin.miller () trojanedbinaries com> wrote:

> VRT supplied snort.conf file that comes with 2.9.0.4 as of today contains this line:
>
> ---snip---
> preprocessor stream5_global: max_tcp 8192, track_tcp yes, track_udp yes, track_icmp no max_active_responses 2 
> min_response_seconds 5
> ^ ^
> |---missing commas?----|
> ---snip---
>
> I guess it still loads it with these options? If not it should look like (separated by line to make easier to read in 
> the email threads):
>
> preprocessor stream5_global: max_tcp 8192,\
> track_tcp yes,\
> track_udp yes,\
> track_icmp no,\
> max_active_responses 2,\
> min_response_seconds 5
>
> Some of those settings are even less than what is turned on by default though it would appear. max_tcp is set to 8192 
> in the VRT conf as shown above, however the 2.9.0.5 manual states:
> --snip--
> max_tcp <num sessions> || Maximum simultaneous TCP sessions tracked. The default is ”262144”, maximum is ”1048576”, 
> minimum is ”1”.
> --snip--
>
> What else is weird is that max_udp is missing in the config and therefor the default value of 131072 would kick in, 
> so the VRT config has you tracking a lot more UDP sessions that TCP sessions with stream5. From the 2.9.0.5 manual:
> --snip--
> max_udp <num sessions> || Maximum simultaneous UDP sessions tracked. The default is ”131072”, maximum is ”1048576”, 
> minimum is ”1”.
> --snip--
>
> Not sure if this is by design or just an artifact from the previous snort.conf's where this has been set to this 
> value forever in recent memory. Value does seem pretty low however.
>
>
> I guess something more like:
>
> preprocessor stream5_global: track_tcp yes,\
> track_udp yes,\
> track_icmp no,\
> max_active_responses 2,\
> min_response_seconds 5
>
> Or:
>
> preprocessor stream5_global: track_tcp yes,\
> max_tcp 262144,\
> track_udp yes,\
> max_udp 131072,\
> track_icmp no,\
> max_active_responses 2,\
> min_response_seconds 5
>
> Thought this might be worthy of review/consideration for others.
>
> -- Eoin

------------------------------------------------------------------------------
WhatsUp Gold - Download Free Network Management Software
The most intuitive, comprehensive, and cost-effective network 
management toolset available today.  Delivers lowest initial 
acquisition cost and overall TCO of any competing solution.
http://p.sf.net/sfu/whatsupgold-sd
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users