[Snort-devel] snort-184.108.40.206 problem imap,pop,smtp paf reassembly
mitesh.jadia at ...2499...
Fri Apr 4 04:11:24 EDT 2014
I found one strange behavior in imap,pop,smtp reassembly when mail has
attachment with mime *content-transfer-encoding = 7bit. *
configuration of paf_max is 16000 and the file has content of plain
text(file-size : 64kb). Ideally I should get reassembled packet when paf
limit is reached or EOF is reached. But I am getting reassembled packet of
1460 bytes after each packet from server(Imap case).
I debugged the code and found the problem with mime_paf function in
file-process utility. It find \r\n in normal text file and flushes the
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-devel