Re: ack packets and data sequence

[Matt Kettler <mkettler () evi-inc com>]

At 01:34 PM 10/26/2004, Jeffrey Starin wrote:
> A nice person responded to my previous query about how to track packets 
> after an alert has been triggered using the dynamic rules.  Okay, that is 
> fine, but it is also bringing in packets that just contain header 
> information and not the raw data.  I did notice that the data I am looking 
> for always has the ack bit set equal to the previous ack bit, whereas the 
> data I am not interested in always has a different ack bit sequence from 
> the previous.  So... I guess my next question would be if there is a way 
> to track only certain ack  bits and how would one actually get that bit 
> into a variable or whatever, to track?

I'd try to avoid looking at the ack sequence number (note that the ack bit 
is just that, one bit, not a number). That's too complicated at this level.

I'd try to use the dsize option instead. Bear in mind however that if your 
using stream reassembly, dsize might not work.



-------------------------------------------------------
This SF.Net email is sponsored by:
Sybase ASE Linux Express Edition - download now for FREE
LinuxWorld Reader's Choice Award Winner for best database on Linux.
http://ads.osdn.com/?ad_id=5588&alloc_id=12065&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users