[Snort-devel] stream4_reassemble

Rajesh Joseph tech_joseph at ...398...
Mon Feb 9 04:48:05 EST 2004


Hi,
  I studying email mointoring system. For that I am
making an application which will log all the mails of
a particauler mail ID.

So added the following preprocessor in the snort.conf

preprocessor stream4_reassemble: both ports 25 80

So that the mail which may be splitted in many packets
can be reassebled.

After that In the rules filed I added neccessary rules
to alert on specific mail.

My problem is that stream4_reassemble is not
assembling the packets.

Can anybody pinpoint the cause

Thanks in advance

Dennis

__________________________________
Do you Yahoo!?
Yahoo! Finance: Get your refund fast by filing online.
http://taxes.yahoo.com/filing.html




More information about the Snort-devel mailing list