[Snort-devel] stream4_reassemble

Rajesh Joseph tech_joseph at ...398...
Mon Feb 9 04:48:05 EST 2004

  I studying email mointoring system. For that I am
making an application which will log all the mails of
a particauler mail ID.

So added the following preprocessor in the snort.conf

preprocessor stream4_reassemble: both ports 25 80

So that the mail which may be splitted in many packets
can be reassebled.

After that In the rules filed I added neccessary rules
to alert on specific mail.

My problem is that stream4_reassemble is not
assembling the packets.

Can anybody pinpoint the cause

Thanks in advance


Do you Yahoo!?
Yahoo! Finance: Get your refund fast by filing online.

More information about the Snort-devel mailing list