Thu Nov 23 16:34:03 EST 2017
# tcp stream reassembly directive
# no arguments loads the default configuration
# Only reassemble the client,
# Only reassemble the default list of ports (See below),
# Give alerts for "bad" streams
And I'll bet that you're just using default options on stream4_reassemble.
:) Have a look a few lines down in the .conf and you'll see this:
# both - reassemble both sides of a session
There ya go.
"When things get weird, the weird turn pro." H.S. Thompson
More information about the Snort-sigs