[Snort-users] Content string search across packets
mkettler at ...4108...
Thu Apr 29 16:29:06 EDT 2004
At 04:39 PM 4/29/2004, sowdambiga karthikeyan wrote:
> I have a general question about the content string search in snort.
> Does snort
>support searching for a string across multiple packets. For eg. can we search
>for a string "ABCDEF" where "ABC" is present in one packet and "DEF" is
>in the next packet.
Depends on what kind of packet you're talking about.
If it's TCP, and no actual data is sent back by the other end in between,
then in general stream4 should cover you there with no special effort.
Stream4 will re-assemble packets of a TCP stream up into hunks and run them
down at least 2 packets at a time, and more than 2 at a time if the packets
With tcp you run into trouble when people try do do things like look for
"abc" and then try to find "def" 20k later in the data stream. Stream4
doesn't work in such a way that you can search an entire tcp session as if
it were one gigantic packet, you're pretty much limited to about 3k of data
If you're talking udp packets, or there's some kind of acknowledgement in
between, then you'll need to use tagging to allow you to chain two separate
rules together to generate an alert.
More information about the Snort-users