[Snort-devel] Question on TCP session creating process

Mingyu Jun jammingyu9 at ...2499...
Thu Apr 27 20:00:47 EDT 2017


I’m analyzing the snort source codes for personal interest.

I have some questions, though I’m not sure if here’s a right place to ask

I’m now at the stream6 preprocessor and seeing how TCP sessions are
created. (snort_stream_tcp.c)

However, I’m confused whether if snort is making a TCP session per
direction(so it will make two TCP sessions per connection), or just one TCP
session per connection.

I tried debugging myself, and saw only one TCP session made per connection.

I’ll be so glad to know that stuff with some details and reasons :)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20170428/25cbe64f/attachment.html>

More information about the Snort-devel mailing list