[Snort-devel] Trivial question
sockstat at ...445...
Wed Sep 11 15:17:29 EDT 2013
When i run http traffic through snort, while snort is in inline mode and monitoring the sizeo of the packets, I see that every 4 of more full mtu packets a packet of 17k bytes is being processed by snort. I am seeing this with most kind of traffic, but not with ftp.
Is that correct or not?
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-devel