[Snort-devel] Looking at spp_tcp_stream3.c

Bart van Kuik bart at ...377...
Fri Jun 8 05:12:32 EDT 2001

I was looking at spp_tcp_stream3.c and I wondered:
shouldn't the || be an && on lines 444 and 456?

I thought, when talking about a client packet, the sequence number of the
RST packet should be bigger then the last server's ACK (since an RST
never gets ACKnowledged) _AND_ it should be smaller then the server
its last ACK plus advertised window. Otherwise, the client would wait
before sending the packet.

Vice versa of course for server packets at line 456.

Please correct me if I'm wrong.


Justify my text? I'm sorry but it has no excuse.

More information about the Snort-devel mailing list