[Snort-devel] I noticed that... stream reassembly + regexps don't mix
Bart van Kuik
bart at ...377...
Sun Jun 17 22:40:00 EDT 2001
Sorry for the double. I thought about how the patch that appeared two,
three weeks ago is not quite compatible with the TCP stream
reassembly. This is because when creating a dummy packet, snort looks
at the longest possible content in the rules. But a regexp could be
longer. So, this is all very theoretically, but I thought I'd just
Fourty is not old. If you're a tree.
More information about the Snort-devel