|Main Archive Page > Month Archives > snort-devel archives|
is there an easy way to make stream5 perform reassembly such that rules can be matched against a sliding window of n bytes? Do I have to write a preprocessor and change the reassembly policy for relevant sessions explicitely? Or is there a way to make the sliding window policy the default? In either cases, how would I set the window size?
Any hint is very much appreciated.