[Snort-devel] HttpFlow question

Chris Green cmg at ...835...
Wed Nov 6 08:05:08 EST 2002


"Kreimendahl, Chad J" <Chad.Kreimendahl at ...1167...> writes:

> Is there a preferred location to put HttpFlow for best performance?  My
> understanding is that it takes the data on the described ports and crops
> it to the specified length (from the http server)... If this is put
> before all others (stream4,portscan2...), will it cause problems? 

Yes. Easiest place to put it is the last line of your preprocessors.

> Also, any chance you guys can add these new functions into the
> default snort.conf for everyone to see?

Dev snort.conf isn't guaranteed to remain the same :)
-- 
Chris Green <cmg at ...402...>
"I'm beginning to think that my router may be confused."




More information about the Snort-devel mailing list