[Snort-devel] Stream4 qn: ACTION_INC_PORT

snort user snort.user at ...2499...
Mon Sep 15 18:16:42 EDT 2008


Hello/Greetings

In spp_stream4.c there is a #define --
#define ACTION_INC_PORT                 0x00000200

UpdateState* functions do not return this action. However, TcpAction
seems to do the following --

        if(action & ACTION_INC_PORT)
        {
            ssn->client.port++;
        }

I am trying to understand about this..

What is/was the purpose of 'ACTION_INC_PORT'.
Is it something that was used earlier but not anymore?

Thanks




More information about the Snort-devel mailing list