[Snort-sigs] Problems using flow quantifier

Joel Esler (jesler) jesler at ...3865...
Thu Mar 5 16:22:28 EST 2015

On Mar 5, 2015, at 3:58 PM, lists at ...3397...<mailto:lists at ...3397...> wrote:

On 03/05/2015 01:41 PM, Research wrote:
Out of curiosity, why was that causing problems ?

Joel?  This has been an issue as long a I've known snort with stream5 +
checksumming.  What is the root cause?

Ultimately the NIC or Virtual NIC if I am understanding the question.  Check out https://www.snort.org/documents

On the page is a document written by William Parker, its called “Possible Packet Loss During Reassembly for Snort IDS/IPS Sensors”  It’s under “Additional Resources”.

Joel Esler
Open Source Manager
Threat Intelligence Team Lead
Talos Group

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20150305/95cd4ad6/attachment.html>

More information about the Snort-sigs mailing list