Snort mailing list archives
What is the relationship between flow: and stream4_reassemble?
From: Jason Haar <Jason.Haar () trimble co nz>
Date: Sat, 08 Jan 2005 16:24:05 +1300
Can someone spell out to me the relationship between the "flow:" option and the stream4 preprocessor?
What concerns me is what happens when I (say) have a rule that alerts on "flow:..." traffic to port 42 - but stream4_reassemble doesn't reassemble port 42? If the answer is "it wouldn't do what you expect", then are the current rules affected by this, and if so, shouldn't some sanity check be implemented to stop that happening (e.g "warning, flow keyword found in rule using port 'any'"...)
i.e. I currently have 62 rules that have ports "any -> ... any ..." in them, and my stream4_reassemble: is set to the default ports of 21 23 25 53 80 110 111 143 and 513. Will those rules work as expected?
-- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 ------------------------------------------------------- The SF.Net email is sponsored by: Beat the post-holiday blues Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek. It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- What is the relationship between flow: and stream4_reassemble? Jason Haar (Jan 07)
- Re: What is the relationship between flow: and stream4_reassemble? Brian Caswell (Jan 08)
- Re: What is the relationship between flow: and stream4_reassemble? Jason Haar (Jan 08)
- Re: What is the relationship between flow: and stream4_reassemble? Brian Caswell (Jan 09)
- Re: What is the relationship between flow: and stream4_reassemble? Jason Haar (Jan 09)
- Re: What is the relationship between flow: and stream4_reassemble? Jason Haar (Jan 08)
- Re: What is the relationship between flow: and stream4_reassemble? Brian Caswell (Jan 08)
- <Possible follow-ups>
- Re: What is the relationship between flow: and stream4_reassemble? M. Shirk (Jan 10)