[Snort-devel] stream based av and snort/Stream5

lynch.meng lynch.meng at ...2499...
Tue Mar 9 10:22:48 EST 2010


hello all!
    I am working for develop a snort preprosessor to do stream based anti virus. 
    I need do mime decodeing and decompress, so reassembled packets should come to my preprosessor sequentially. 
client side packet have no problem, but i can not get packet with PKT_REBUILT_STREAM flags from server side?

snort version 2.8.x. 
stream5 config:
preprocessor stream5_global: max_tcp 8192, track_tcp yes, track_udp no
preprocessor stream5_tcp: policy first, ports both 80


thanks!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20100309/c4377b72/attachment.html>


More information about the Snort-devel mailing list