[Snort-devel] Stream4 - Random Flush points

Martin Roesch roesch at ...402...
Tue Oct 5 07:33:18 EDT 2004

The random flush points are there to hinder evasion, if the flush 
points are unpredictable then it will be harder to span an attack 
across two flushes.


On Oct 5, 2004, at 5:55 AM, Dennis George wrote:

> Hi all,
> Can anybody tell me that why a random flush point is taken in 
> snort..... why don't we use some static flush points.....
> I am talking about spp_stream4.c file... In this to flush a stream it 
> is checked with a flush_point stored in the session which is randomly 
> chosen...
> Thanks in advance.
> Dennis
> Do you Yahoo!?
> New and Improved Yahoo! Mail - 100MB free storage!
Martin Roesch - Founder/CTO, Sourcefire Inc. - +1-410-290-1616
Sourcefire - Discover.  Determine.  Defend.
roesch at ...402... - http://www.sourcefire.com
Snort: Open Source Network IDS - http://www.snort.org

More information about the Snort-devel mailing list