[Snort-devel] Trivial question

Reinoud Koornstra sockstat at ...445...
Wed Sep 11 15:17:29 EDT 2013


Dear Everyone,

 

When i run http traffic through snort, while snort is in inline mode and monitoring the sizeo of the packets, I see that every 4 of more full mtu packets a packet of 17k bytes is being processed by snort. I am seeing this with most kind of traffic, but not with ftp.

Is that correct or not?

Thanks,

 

Reinoud.
 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20130911/19aa4846/attachment.html>


More information about the Snort-devel mailing list