[Snort-users] (no subject)

sumit vora sumitvora at ...1396...
Sun Feb 22 15:40:03 EST 2004

Hi folks...

Can anyone tell me...When Snort is "examining" the
content of a packet...What happens...does it hold the
packet at the gateway, and look for one string, say
"chmod" all over the packet, as one rule might
supposedly say, then, look for another, and another,
and so on...?

Meaning, Does it look for all strings of interest in
all the 2000 rules that are now posted on the link at
the same time, or, does it hold the packet until each
string of interest has been looked up, (i.e. Does it
examine the packet payload several times for different
strings, or, just once, for all strings)...

And, if only once, for all strings, how does snort
take into account different depths to which the packet
must be searched for different strings, and give a
result without false positives?????????

Please folks...Serious doubt, and gotta get over

I'd appreciate any help...



Yahoo! Messenger - Communicate instantly..."Ping" 
your friends today! Download Messenger Now 

More information about the Snort-users mailing list