[Snort-users] TCP Portals: The Handshake's a Lie!

CunningPike cunningpike at ...11827...
Tue Nov 17 15:11:46 EST 2009


I haven't seen much commentary on this:
http://www.breakingpointsystems.com/community/blog/tcp-portals-the-three-way-handshake-is-a-lie.
Do any of the snort sigs or preprocessors rely on a SYN/ACK packet for state
and/or flow?

CP
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20091117/442127a3/attachment.html>


More information about the Snort-users mailing list