[Snort-devel] TCP stream reassembly - where is the boundary for a stream_pkt

Julie Do julie_do at ...445...
Wed May 7 11:21:02 EDT 2003

When SNORT does TCP stream reassembly,
what condition is used to decide that a group of packets received for a 
stream should be reassembled together into a single stream packet ?
  what is the condition to decide that we reached the "boundary" of a stream 
short of decoding the application layer you have no easy way of knowing 
where the
boundaries are ...???


The new MSN 8: smart spam protection and 2 months FREE*  

More information about the Snort-devel mailing list