[Snort-devel] spp_conversation preprocessor

Steven Sturges steve.sturges at ...402...
Mon Jul 28 08:51:12 EDT 2008


spp_conversation watched a list of allowed IP protocols and
created session data, similar to what stream does now.
It interacted with portscan2.

Both were last available with Snort 2.4.5.

 From what I recall, neither interacted with flow or clientserver
(flow rule keyword).

Cheers.
-steve

Adayadil Thomas wrote:
> Greetings.
> 
> I am aware that the spp_conversation preprocessor is deprecated,
> but can someone tell me what the purpose of this preprocessor was?
> Does this have any relation to flow? or sp_clientserver.c?
> 
> Thanks
> 
> -------------------------------------------------------------------------
> This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
> Build the coolest Linux based applications with Moblin SDK & win great prizes
> Grand prize is a trip for two to an Open Source event anywhere in the world
> http://moblin-contest.org/redirect.php?banner_id=100&url=/
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-devel
> 




More information about the Snort-devel mailing list