[Snort-devel] noinspect parameter in stream4

Steven Sturges steve.sturges at ...402...
Mon Aug 13 09:24:12 EDT 2007


It disables stateful inspection for ports that are not listed in the
reassemble list... So, for any rules that use flow:to_server, etc
options, they will not trigger unless the port is in the list for
reassembly.

Cheers.
-steve

snort user wrote:
> Greetings
> 
> I have a question with the stream4 preprocessor. I hope someone can
> answer it even though stream4 is getting obsolete.
> 
> If I specify noinspect in the stream4 config, it should disable
> stateful inspection altogether
> for all ports ?
> or it will disable stateful inspection for ports not listed in the
> stream4_reassemble list?
> 
> Thanks
> 
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc.
> Still grepping through log files to find problems?  Stop.
> Now Search log events and configuration files using AJAX and a browser.
> Download your FREE copy of Splunk now >>  http://get.splunk.com/
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-devel
> 




More information about the Snort-devel mailing list