[Snort-devel] HttpFlow question

Kreimendahl, Chad J Chad.Kreimendahl at ...1167...
Wed Nov 6 07:58:21 EST 2002


Is there a preferred location to put HttpFlow for best performance?  My
understanding is that it takes the data on the described ports and crops
it to the specified length (from the http server)... If this is put
before all others (stream4,portscan2...), will it cause problems?  Also,
any chance you guys can add these new functions into the default
snort.conf for everyone to see?

Thanks, 
CJK




More information about the Snort-devel mailing list