[Snort-devel] signature content split across multiple packets

Russell Fulton r.fulton at ...1343...
Thu Jan 13 18:41:01 EST 2005


On Thu, 2005-01-13 at 15:10 -0800, i mawsog wrote:
> Are stream4 and stream4_reassemeble supposed to do
> content matching across multiple unfragmented packets

Yes, that is what the stream4 processor is for.

Russell





More information about the Snort-devel mailing list