[Snort-devel] stream5 reassembly question
tillmann.werner at ...578...
Fri Mar 7 14:19:09 EST 2008
is there an easy way to make stream5 perform reassembly such that rules
can be matched against a sliding window of n bytes? Do I have to write a
preprocessor and change the reassembly policy for relevant sessions
explicitely? Or is there a way to make the sliding window policy the
default? In either cases, how would I set the window size?
Any hint is very much appreciated.
More information about the Snort-devel