[Snort-users] preproccesor stream

Vitaly McLain twistah at ...93...
Thu Jan 18 22:20:32 EST 2001


I may be wrong (happens alot), but this could be the TCP stream assembler,
which does what you said. It can help Snort detect attacks designed to evade
IDS, like session splicing.

Vitaly McLain
twistah at ...93...
twistah @ OPN & EfNet
"If you don't turn on to politics, politics will turn on you."
       - Ralph Nader





More information about the Snort-users mailing list