[Snort-devel] flow nomenclature

Chris Green cmg at ...402...
Thu Apr 4 19:18:04 EST 2002

Bob Fleck <bfleck at ...1230...> writes:

> On Thu, Apr 04, 2002 at 05:23:33PM -0500, Benjamin.Feinstein at ...1192... wrote:
>> Additionally, peer-to-peer protocols (e.g., Gnutella, Kaaza) do not
>> necessarily have any concept of "client" or "server". I suggest that the
> Most of the Gnutella style "peer-to-peer" networks are in reality a collection of
> nodes that perform the roles of both a HTTP server and client.  The act as clients
> when requesting downloads or searches from other machines, and as servers when
> answering those requests.  For these systems, I think the existing flow
> nomenclature is fine.

Yup.  They have a initiator which will be the client and a respondant
which will be the server

if you want to point out broken nomenclature, use active FTP sessions

Chris Green <cmg at ...402...>
 "Not everyone holds these truths to be self-evident, so we've worked
                  up a proof of them as Appendix A." --  Paul Prescod

More information about the Snort-devel mailing list