[Snort-devel] Stream4 - Random Flush points
roesch at ...402...
Tue Oct 5 07:33:18 EDT 2004
The random flush points are there to hinder evasion, if the flush
points are unpredictable then it will be harder to span an attack
across two flushes.
On Oct 5, 2004, at 5:55 AM, Dennis George wrote:
> Hi all,
> Can anybody tell me that why a random flush point is taken in
> snort..... why don't we use some static flush points.....
> I am talking about spp_stream4.c file... In this to flush a stream it
> is checked with a flush_point stored in the session which is randomly
> Thanks in advance.
> Do you Yahoo!?
> New and Improved Yahoo! Mail - 100MB free storage!
Martin Roesch - Founder/CTO, Sourcefire Inc. - +1-410-290-1616
Sourcefire - Discover. Determine. Defend.
roesch at ...402... - http://www.sourcefire.com
Snort: Open Source Network IDS - http://www.snort.org
More information about the Snort-devel