[Snort-devel] flush_behavior in stream4

Steven Sturges steve.sturges at ...402...
Fri Aug 19 13:42:44 EDT 2005


Hi Eric--

Yes, the value should've been FLUSH_BEHAVIOR_LARGE.  It is fixed
in the latest CVS repository... We caught that just after 2.4.0
was released.

Cheers.
-steve

> -----Original Message-----
> From: snort-devel-admin at lists.sourceforge.net 
> [mailto:snort-devel-admin at lists.sourceforge.net] On Behalf Of 
> Eric Maheo
> Sent: Friday, August 19, 2005 4:12 PM
> To: snort-devel at lists.sourceforge.net
> Subject: [Snort-devel] flush_behavior in stream4
> 
> Hi,
> 
> in the spp_stream4.c line 1660
> 
> void Stream4InitReassembler(u_char *args){ .......
> else if(!strncasecmp(index, "flush_behavior", 14))
>         {
> ........
> 
>             }
>             else if (!strncasecmp(value, "large_window", 12))
>             {
>                 s4data.flush_behavior = FLUSH_BEHAVIOR_RANDOM;
>             }
> ......
> 
> shouldn't be s4data.flush_behavior = FLUSH_BEHAVIOR_LARGE; ?
> 
> 
> Also, the documentation snort_manual.pdf documents some options for
> stream4 that belong to stream4_reassemble like 
> flush_behavior/flush_seed.. flush_behavior <number> when it 
> takes a string as value. The snort.conf is correct, tho.
> 
> 
> 
> Thanks,
> 
> 
> -- 
> 
> Eric Maheo
> Vice President of Engineering,
> 
> Applied Watch Technologies, LLC
> 1134 N. Main St.
> Algonquin, IL 60102
> 
> Tel: (877) 262-7593 x324
> Fax: (877) 262-7593
> 
> Email: eric.maheo at ...2803...
> Web: http://www.appliedwatch.com
> 
> 
> 
> -------------------------------------------------------
> SF.Net email is Sponsored by the Better Software Conference & 
> EXPO September 19-22, 2005 * San Francisco, CA * Development 
> Lifecycle Practices Agile & Plan-Driven Development * 
> Managing Projects & Teams * Testing & QA Security * Process 
> Improvement & Measurement * http://www.sqe.com/bsce5sf 
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-devel
> 





More information about the Snort-devel mailing list