[Snort-devel] TCP stream reassembly - where is the boundary for a stream_pkt

Julie Do julie_do at ...445...
Wed May 7 11:21:02 EDT 2003


When SNORT does TCP stream reassembly,
what condition is used to decide that a group of packets received for a 
stream should be reassembled together into a single stream packet ?
  what is the condition to decide that we reached the "boundary" of a stream 
packet?
short of decoding the application layer you have no easy way of knowing 
where the
boundaries are ...???

thanks
Julie

_________________________________________________________________
The new MSN 8: smart spam protection and 2 months FREE*  
http://join.msn.com/?page=features/junkmail





More information about the Snort-devel mailing list