No subject

Thu Nov 23 16:34:03 EST 2017

  # tcp stream reassembly directive
  # no arguments loads the default configuration
  #   Only reassemble the client,
  #   Only reassemble the default list of ports (See below),
  #   Give alerts for "bad" streams

And I'll bet that you're just using default options on stream4_reassemble.
:)  Have a look a few lines down in the .conf and you'll see this:

  #   both - reassemble both sides of a session

There ya go.


Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson

More information about the Snort-sigs mailing list