[Snort-sigs] Window size

Brian bmc at ...95...
Thu Jun 12 07:24:07 EDT 2003


On Wed, Jun 11, 2003 at 01:49:45PM -0700, Bill McCarty wrote:
> I can't find a Snort rule option that tests TCP window size. Am I missing 
> it? If not, is there some way to test this value?

Snort has support for checking the window size.  It has been an
undocumented feature for the last 2 years.

   window:[!]<window_size>;

-brian




More information about the Snort-sigs mailing list