[Snort-sigs] dsize - fails on rebuilt streams
jamesaffeld at ...144...
Fri Aug 19 16:58:20 EDT 2005
By 'rebuilt streams' I think that means packets
collected into a single pseudo-packet for analysis.
Stream4/frag2 do this, if I'm not mistaken.
Does this include http_inspect? It presents an
altered packet which may be larger/smaller than the
If I do a uricontent with a dsize - is there a problem?
Start your day with Yahoo! - make it your home page
More information about the Snort-sigs