[Snort-devel] DCERPC2 Questions

snort user snort.user at ...2499...
Wed Sep 9 15:07:26 EDT 2009


Hello !

After dcerpc2 processing, is it a pseudo packet that goes thru the
matching engine?
[ i.e. passed to Detect( ) ]
In case of an alert, is there a way to log the actual packet payload?

Also could someone explain briefly the use of stack in dcerpc2
- DCE2_CStackTop
- DCE2_PushPkt
- DCE2_PopPkt


Thanks much for the help!




More information about the Snort-devel mailing list