[Snort-sigs] How to reapply a sig on packets in a same session

Chich Thierry thierry.chich at ...2579...
Wed Jul 14 13:13:37 EDT 2004


I would allow snort to apply the same sig on packets that
are belonging of a same session.

The context : I am trying to kill bittorrent
connexions with a reset tcp. However, this is not working each time.
Sometimes, the connexion between the peers stay alive.

Since the sig is apply only once on a single session, if the session survive
one time, it stay alive for all time.

Is it something that can precise that a signature must be match on
the datagrams without taking care of the stream ?

Thierry




More information about the Snort-sigs mailing list