[Snort-users] ack packets and data sequence

Matt Kettler mkettler at ...4108...
Tue Oct 26 10:46:02 EDT 2004


At 01:34 PM 10/26/2004, Jeffrey Starin wrote:
>A nice person responded to my previous query about how to track packets 
>after an alert has been triggered using the dynamic rules.  Okay, that is 
>fine, but it is also bringing in packets that just contain header 
>information and not the raw data.  I did notice that the data I am looking 
>for always has the ack bit set equal to the previous ack bit, whereas the 
>data I am not interested in always has a different ack bit sequence from 
>the previous.  So... I guess my next question would be if there is a way 
>to track only certain ack  bits and how would one actually get that bit 
>into a variable or whatever, to track?

I'd try to avoid looking at the ack sequence number (note that the ack bit 
is just that, one bit, not a number). That's too complicated at this level.

I'd try to use the dsize option instead. Bear in mind however that if your 
using stream reassembly, dsize might not work.





More information about the Snort-users mailing list