[Snort-devel] dsize broken in snort 2 (and possibly 1.9.x)

Chris Green cmg at ...835...
Tue Oct 29 12:53:04 EST 2002


"Kreimendahl, Chad J" <Chad.Kreimendahl at ...1167...> writes:

> It appears that in at least v2 of snort that dsize is not working for
> any rule that uses it.  Anyone else experienced this?

dsize should not be used for things coming out of the stream
reassembler and the sig set needs to be audited for things that rely
on it.

Do you have an example packet that you are expecting to see go off?
-- 
Chris Green <cmg at ...402...>
This is my signature. There are many like it but this one is mine.




More information about the Snort-devel mailing list