[Snort-users] Session mixup by stream4
gupta_sonali at ...6743...
Mon Feb 7 04:26:33 EST 2005
I came across this post in the neohapsis archives, which discusses an issue similar to what I seem to be facing.
It is at:
The discussion talks about a session payload mixup in data captured by snort. I am also facing this issue in some sessions that I get from snort. I am using snort 2.0 and snort 2.3 ORC2, and found the issue in both versions. Chris mentioned in the post that the issue has been fixed in HEAD CVS. The discussion was about version 1.9.0. Since I am using a newer version of snort, could you please tell me if the same fix has been applied to the newer versions, or is there some update I need to get to fix it.
In order to figure out the session mix up issue, I did the following
a) Ran two snorts simultaneously Snort-A and Snort-B. The Snort-A captures the traffic and dumps it in a tcpdump format, using the b option and Snort-B creates the sessions real time.
b) Then I ran Snort-C (same executable as of Snort-B), which created session from the tcpdump produced by Snort-A. I found that the sessions created by Snort-C for the problematic ones were not identical to the sessions created by Snort-B and I also noticed that the sessions created by Snort-C has lesser number of session mixups.
I also noted that some sessions created by Snort-B, which appeared incomplete (data from last one or two packets were missing) were fully formed when created by Snort-C.
Is there any difference between the session reassemble real time and session reassemble using r option.
During the test, we had tweaked Snort-B a bit so that it dumps all the sessions that are reassembled. We did this by hard coding gotevent = 1 and commenting the call to the preprocessor function in FlushStream function of ssp_stream4.c.
// gotevent = Preprocess(stream_pkt); //Commented
gotevent = 1;
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-users