[Snort-devel] Stream4 - Random Flush points

Martin Roesch roesch at ...402...
Tue Oct 5 07:33:18 EDT 2004


The random flush points are there to hinder evasion, if the flush 
points are unpredictable then it will be harder to span an attack 
across two flushes.

      -Marty

On Oct 5, 2004, at 5:55 AM, Dennis George wrote:

> Hi all,
>
> Can anybody tell me that why a random flush point is taken in 
> snort..... why don't we use some static flush points.....
>
> I am talking about spp_stream4.c file... In this to flush a stream it 
> is checked with a flush_point stored in the session which is randomly 
> chosen...
>
> Thanks in advance.
>
> Dennis
>
>  
>
> Do you Yahoo!?
> New and Improved Yahoo! Mail - 100MB free storage!
-- 
Martin Roesch - Founder/CTO, Sourcefire Inc. - +1-410-290-1616
Sourcefire - Discover.  Determine.  Defend.
roesch at ...402... - http://www.sourcefire.com
Snort: Open Source Network IDS - http://www.snort.org





More information about the Snort-devel mailing list