[Snort-devel] TCP stream reassembly - where is the boundary for a stream_pkt
julie_do at ...445...
Wed May 7 11:21:02 EDT 2003
When SNORT does TCP stream reassembly,
what condition is used to decide that a group of packets received for a
stream should be reassembled together into a single stream packet ?
what is the condition to decide that we reached the "boundary" of a stream
short of decoding the application layer you have no easy way of knowing
boundaries are ...???
The new MSN 8: smart spam protection and 2 months FREE*
More information about the Snort-devel