[Snort-users] Tagged packets

Dirk Geschke Dirk_Geschke at ...1344...
Tue Aug 30 06:32:10 EDT 2005


Hi Hin,

> I'm receiving tagged packets but interesting enough, it doesn't come from signatures with a tag parameter. Now, I have searched the archive and there are numerous answers on this question. Is there an official answer on this question? Stream4, unified output plugin, what is it? Is there a way to fix this?

what do you mean with fix?

Snort reassembles fragmented packets, with TCP this is done in stream4.
So finally the full packet gets there reassembled to a bigger one.

The unified output plugin decomposes this big packet in the original
smaller one (although the individual headers are lost).

If you like to use the full packet instead of the smaller tagged
ones you should simply use another output plugin. (Or remove the
decomposition of the big packet in the unified output plugin.)

But this works as designed, so why (or how) should it be fixed?

Best regards

Dirk





More information about the Snort-users mailing list