[Snort-users] Stream5 reassembly ports

NIDS TEAM nidsteam at ...11827...
Mon Jun 2 01:18:36 EDT 2014


Hi waldo kitty

Thanks for your reply, although it does not yet kill my questions :-) I was
thinking that all packets that do not have either client port or server
port equal to the configured ones will not be handled by Stream5 at all.
Thus I would expect all packets to directly get forwarded without any
buffering. Or I do not know what you mean with your comment that they need
to get buffered anyways, what for?

So what is the exact meaning of 'ports client' and 'ports both' then? I
always thought of Stream5 as a 'pure' Reassembly module which only needs to
buffer packets in case they need to get reassembled.

thanks
guh


On Wed, May 28, 2014 at 8:22 AM, NIDS TEAM <nidsteam at ...11827...> wrote:

> Hi
>
> Thanks for your reply, although it does not yet kill my questions :-) I
> was thinking that all packets that do not have either client port or server
> port equal to the configured ones will not be handled by Stream5 at all.
> Thus I would expect all packets to directly get forwarded without any
> buffering. Or I do not know what you mean with your comment that they need
> to get buffered anyways, what for?
>
> So what is the exact meaning of 'ports client' and 'ports both' then? I
> always thought of Stream5 as a 'pure' Reassembly module which only needs to
> buffer packets in case they need to get reassembled.
>
> thanks
> guh
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20140602/6a2452c9/attachment.html>


More information about the Snort-users mailing list