[Snort-sigs] Window size

Bill McCarty bmccarty at ...1604...
Thu Jun 12 10:42:41 EDT 2003


Hi Brian and all,

Megacool! Should I ask what else is hidden under the hood? Or, must I find 
time to browse the source <g>.

Cheers,

--On Thursday, June 12, 2003 10:23 AM -0400 Brian <bmc at ...95...> wrote:

> On Wed, Jun 11, 2003 at 01:49:45PM -0700, Bill McCarty wrote:
>> I can't find a Snort rule option that tests TCP window size. Am I
>> missing  it? If not, is there some way to test this value?
>
> Snort has support for checking the window size.  It has been an
> undocumented feature for the last 2 years.
>
>    window:[!]<window_size>;
>
> -brian
>
>
> -------------------------------------------------------
> This SF.NET email is sponsored by: eBay
> Great deals on office technology -- on eBay now! Click here:
> http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-sigs
>



---------------------------------------------------
Bill McCarty




More information about the Snort-sigs mailing list