[Snort-devel] I noticed that... stream reassembly + regexps don't mix

Bart van Kuik bart at ...377...
Sun Jun 17 22:40:00 EDT 2001


Sorry for the double. I thought about how the patch that appeared two,
three weeks ago is not quite compatible with the TCP stream
reassembly. This is because when creating a dummy packet, snort looks
at the longest possible content in the rules. But a regexp could be
longer. So, this is all very theoretically, but I thought  I'd just
mention it.

Bart

-- 
Fourty is not old. If you're a tree.






More information about the Snort-devel mailing list