[Snort-devel] Snort and pseudo packet
snort.user at ...2499...
Thu Oct 22 15:25:53 EDT 2009
With stream4 there was a concept of pseudo packet; i.e. multiple
tcp segments would be reassembled together into a larger than 1500 byte
pseudo packet and subsequently passed through th ematching engine.
Does stream5 have a similar concept or is it different.
If it is different, can anyone mention briefly about the new approach.
Thanks much !
More information about the Snort-devel