snort-devel March 2008 archive
Main Archive Page > Month Archives  > snort-devel archives
snort-devel: [Snort-devel] stream5 reassembly question

[Snort-devel] stream5 reassembly question

From: Tillmann Werner <tillmann.werner_at_nospam>
Date: Fri Mar 07 2008 - 19:19:09 GMT


is there an easy way to make stream5 perform reassembly such that rules can be matched against a sliding window of n bytes? Do I have to write a preprocessor and change the reassembly policy for relevant sessions explicitely? Or is there a way to make the sliding window policy the default? In either cases, how would I set the window size?

Any hint is very much appreciated.


This email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008.

Snort-devel mailing list