[Snort-devel] flush_behavior in stream4

Eric Maheo eric.maheo at ...2803...
Fri Aug 19 13:13:20 EDT 2005


Hi,

in the spp_stream4.c line 1660

void Stream4InitReassembler(u_char *args){
.......
else if(!strncasecmp(index, "flush_behavior", 14))
        {
........

            }
            else if (!strncasecmp(value, "large_window", 12))
            {
                s4data.flush_behavior = FLUSH_BEHAVIOR_RANDOM;
            }
......

shouldn't be s4data.flush_behavior = FLUSH_BEHAVIOR_LARGE; ?


Also, the documentation snort_manual.pdf documents some options for
stream4 that belong to stream4_reassemble like
flush_behavior/flush_seed.. flush_behavior <number> when it takes a
string as value. The snort.conf is correct, tho.



Thanks,


-- 

Eric Maheo
Vice President of Engineering,

Applied Watch Technologies, LLC
1134 N. Main St.
Algonquin, IL 60102

Tel: (877) 262-7593 x324
Fax: (877) 262-7593

Email: eric.maheo at ...2803...
Web: http://www.appliedwatch.com





More information about the Snort-devel mailing list