Question on TCP session creating process

[Mingyu Jun <jammingyu9 () gmail com>]

Hello,





I’m analyzing the snort source codes for personal interest.



I have some questions, though I’m not sure if here’s a right place to ask
about.



I’m now at the stream6 preprocessor and seeing how TCP sessions are
created. (snort_stream_tcp.c)



However, I’m confused whether if snort is making a TCP session per
direction(so it will make two TCP sessions per connection), or just one TCP
session per connection.



I tried debugging myself, and saw only one TCP session made per connection.



I’ll be so glad to know that stuff with some details and reasons :)

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot

_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel

Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel

Please visit http://blog.snort.org for the latest news about Snort!