[Snort-devel] HttpFlow question
cmg at ...835...
Wed Nov 6 08:05:08 EST 2002
"Kreimendahl, Chad J" <Chad.Kreimendahl at ...1167...> writes:
> Is there a preferred location to put HttpFlow for best performance? My
> understanding is that it takes the data on the described ports and crops
> it to the specified length (from the http server)... If this is put
> before all others (stream4,portscan2...), will it cause problems?
Yes. Easiest place to put it is the last line of your preprocessors.
> Also, any chance you guys can add these new functions into the
> default snort.conf for everyone to see?
Dev snort.conf isn't guaranteed to remain the same :)
Chris Green <cmg at ...402...>
"I'm beginning to think that my router may be confused."
More information about the Snort-devel