Thu Nov 23 16:31:58 EST 2017
220.127.116.11 stream4_reassemble format
preprocessor stream4_reassemble: [clientonly], [serveronly],\
[noalerts], [ports <portlist>]
The default is to only reassemble client packets (at least in 2.1.x)
preprocessor stream4_reassemble both
should reassemble client packets and server packets.
Mike Wisener, GCIA
Senior Information Security Analyst
LURHQ -- http://www.lurhq.com
mwisener at ...118...
This E-mail and any of its contents may contain LURHQ proprietary informati=
which is privileged, confidential, or subject to copyright belonging to=20
LURHQ. This E-mail is intended solely for the use of the individual or enti=
to which it is addressed. If you are not the intended recipient of this=20
E-mail, you are hereby notified that any dissemination, distribution,=20
copying, or action taken in relation to the contents of and attachments to=
this E-mail is strictly prohibited and may be unlawful. If you have receive=
this E-mail in error, notify the sender immediately and permanently delete=
the original and any copy of this E-mail.
On Thursday 13 January 2005 21:39, Russell Fulton wrote:
> On Thu, 2005-01-13 at 15:10 -0800, i mawsog wrote:
> > Are stream4 and stream4_reassemeble supposed to do
> > content matching across multiple unfragmented packets
> Yes, that is what the stream4 processor is for.
More information about the Snort-devel