No subject


Thu Nov 23 16:31:58 EST 2017


2.1.4.2 stream4_reassemble format
preprocessor stream4_reassemble: [clientonly], [serveronly],\
                                 [noalerts], [ports <portlist>]

The default is to only reassemble client packets (at least in 2.1.x)

preprocessor stream4_reassemble both

should reassemble client packets and server packets.

Regards,

- Mike

--=20
Mike Wisener, GCIA
Senior Information Security Analyst
LURHQ -- http://www.lurhq.com
mwisener at ...118...

This E-mail and any of its contents may contain LURHQ proprietary informati=
on,=20
which is privileged, confidential, or subject to copyright belonging to=20
LURHQ. This E-mail is intended solely for the use of the individual or enti=
ty=20
to which it is addressed. If you are not the intended recipient of this=20
E-mail, you are hereby notified that any dissemination, distribution,=20
copying, or action taken in relation to the contents of and attachments to=
=20
this E-mail is strictly prohibited and may be unlawful. If you have receive=
d=20
this E-mail in error, notify the sender immediately and permanently delete=
=20
the original and any copy of this E-mail.

On Thursday 13 January 2005 21:39, Russell Fulton wrote:
> On Thu, 2005-01-13 at 15:10 -0800, i mawsog wrote:
> > Are stream4 and stream4_reassemeble supposed to do
> > content matching across multiple unfragmented packets
>
> Yes, that is what the stream4 processor is for.
>
> Russell





More information about the Snort-devel mailing list