[Snort-sigs] dsize - fails on rebuilt streams

James Affeld jamesaffeld at ...144...
Fri Aug 19 16:58:20 EDT 2005


By 'rebuilt streams' I think that means packets
collected into a single pseudo-packet for analysis. 
Stream4/frag2 do this, if I'm not mistaken.  

Does this include http_inspect?  It presents an
altered packet which may be larger/smaller than the
original.

If I do a uricontent with a dsize - is there a problem?


		
____________________________________________________
Start your day with Yahoo! - make it your home page 
http://www.yahoo.com/r/hs 
 




More information about the Snort-sigs mailing list