[Snort-devel] stream5 reassembly question

Tillmann Werner tillmann.werner at ...578...
Fri Mar 7 14:19:09 EST 2008


is there an easy way to make stream5 perform reassembly such that rules 
can be matched against a sliding window of n bytes? Do I have to write a 
preprocessor and change the reassembly policy for relevant sessions 
explicitely? Or is there a way to make the sliding window policy the 
default? In either cases, how would I set the window size?

Any hint is very much appreciated.


More information about the Snort-devel mailing list