[Snort-devel] Snort and pseudo packet

snort user snort.user at ...2499...
Thu Oct 22 15:25:53 EDT 2009


Hello all,

With stream4 there was a concept of pseudo packet; i.e. multiple
tcp segments would be reassembled together into a larger than 1500 byte
pseudo packet and subsequently passed through th ematching engine.

Does stream5 have a similar concept or is it different.
If it is different, can anyone mention briefly about the new approach.

Thanks much !




More information about the Snort-devel mailing list