[Snort-users] Content string search across packets

Matt Kettler mkettler at ...4108...
Thu Apr 29 16:29:06 EDT 2004

At 04:39 PM 4/29/2004, sowdambiga karthikeyan wrote:
>   I have a general question about the content string search in snort. 
> Does snort
>support searching for a string across multiple packets. For eg. can we search
>for a string "ABCDEF" where "ABC" is present in one packet and "DEF" is 
>in the next packet.

Depends on what kind of packet you're talking about.

If it's TCP, and no actual data is sent back by the other end in between, 
then in general stream4 should cover you there with no special effort. 
Stream4 will re-assemble packets of a TCP stream up into hunks and run them 
down at least 2 packets at a time, and more than 2 at a time if the packets 
are small.

With tcp you run into trouble when people try do do things like look for 
"abc" and then try to find "def" 20k later in the data stream. Stream4 
doesn't work in such a way that you can search an entire tcp session as if 
it were one gigantic packet, you're pretty much limited to about 3k of data 
at most.

If you're talking udp packets, or there's some kind of acknowledgement in 
between, then you'll need to use tagging to allow you to chain two separate 
rules together to generate an alert.

More information about the Snort-users mailing list