[Snort-sigs] stream5 and use_static_footprint_sizes

Guise McAllaster guise.mcallaster at ...2420...
Mon Dec 7 16:44:58 EST 2009


Hi,

I inherited some snorts and noticed that they all had the
'use_static_footprint_sizes' option enabled for the streams5 preprocessor.
Can someone please give me more info about this.  I am reading in the manual
where it recommends not to have this turned on in production but it looks
like a lot of people use it.  Why?

The README says it emulates stream4 flushing of reassembled packets but I
still do not know what this means.

Thx.

--Guise
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20091207/3d3c4778/attachment.html>


More information about the Snort-sigs mailing list