[Snort-sigs] dsize - fails on rebuilt streams

James Affeld jamesaffeld at ...144...
Fri Aug 19 16:58:20 EDT 2005

By 'rebuilt streams' I think that means packets
collected into a single pseudo-packet for analysis. 
Stream4/frag2 do this, if I'm not mistaken.  

Does this include http_inspect?  It presents an
altered packet which may be larger/smaller than the

If I do a uricontent with a dsize - is there a problem?

Start your day with Yahoo! - make it your home page 

More information about the Snort-sigs mailing list