Main Archive Page > Month Archives  > snort-devel archives

[Snort-devel] stream5 reassembly question

From: Tillmann Werner <tillmann.werner_at_nospam>
Date: Fri Mar 07 2008 - 19:19:09 GMT
To: Snort-devel@lists.sourceforge.net

Greetings,

is there an easy way to make stream5 perform reassembly such that rules can be matched against a sliding window of n bytes? Do I have to write a preprocessor and change the reassembly policy for relevant sessions explicitely? Or is there a way to make the sliding window policy the default? In either cases, how would I set the window size?

Any hint is very much appreciated.

Thanks,
Tillmann

---

This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

---

Snort-devel mailing list
Snort-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-devel