[Snort-users] Tiny Fragments

Fyodor fygrave at ...121...
Sat Oct 7 03:21:09 EDT 2000


~ :> 
~ :> What about a Telnet connection, where one byte of data is sent
~ :> with each keystroke?  Or SYN/SYN-ACK and RST packets are all
~ :> smaller then 128 bytes.  I must be missing how you are 
~ :> implementing this.  Should a fragment preproccessor be looking
~ :> for something smaller the 40 bytes?
~ :> 
~ :> Just trying to learn.
~ :
~ :No worries... no such thing as stupid questions, just stupid answers. :-)
~ :

 To comment telnet question, yep, one byte of data might be sent with each
keystroke but you don't have fragmented packets in this case iether. You
have a complete tcp datagram wrapped into a complete ip packet all the
time. :)






More information about the Snort-users mailing list