[Snort-users] Session mixup by stream4

Matt Kettler mkettler at ...4108...
Tue Feb 8 08:57:47 EST 2005

At 04:30 AM 2/8/2005, Sonali Gupta wrote:
>Is there any difference between the session reassemble real time and
>session reassemble using ­r option.

There's little difference between the two, the only significant difference 
I know if is that there's no packet drops when using -r.

Did you check for packet drops in your earlier tests? Did snort B drop more 
packets than A?

More information about the Snort-users mailing list