Snort mailing list archives
Re: snort mixes multiple (unrelated) payloads into one alert
From: Jason Brvenik <jasonb () sourcefire com>
Date: Mon, 24 Jul 2006 13:23:25 -0400
Frank Knobbe wrote:
On Sun, 2006-07-23 at 23:34 -0400, Jason wrote:\"This will cause Stream4 to zero out the memory of the rebuilt packet before copying in the new data. So, when packets are missing from the middle of the rebuilt packet, you'll get 0x00 in those bytes, rather than whatever was there from the previous rebuild." The problem is packet loss. A single buffer is used for reassembly. If you are missing packets when reassembly is done then the old data is still in the gaps...Yeah, I remember that we've discussed that before now :) But a question comes to mind: When Snort reassembles the stream, shouldn't it be able to tell which segments are reassembled and which not? Snort should be able to fill the first segment, the third segment, the fourth segment, and then realize that it never got the second segment, then null just that before sending the packet to the matching engine. Nulling the whole buffer before reassembly seems like a waste of resources, which is probably why a lot of folks don't turn it on. I believe you guys even warned about the performance impact. To me, the solution would seem to write the stream4 such that is recognizes a missing segment and nulls just that. From a performance standpoint, it should require as much as copying an existing segment into the stream.
I doubt it would make enough difference to matter. Packet loss is packet loss and the ultimate game has been lost at that point. zero_flushed_packets only helps to remove erroneous events, not solve the real problem.
Thoughts? Cheers, Frank ------------------------------------------------------------------------ ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys -- and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV ------------------------------------------------------------------------ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys -- and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- snort mixes multiple (unrelated) payloads into one alert Eric J. Bowser (Jul 21)
- Re: snort mixes multiple (unrelated) payloads into one alert Gentoo-Wally (Jul 21)
- Re: snort mixes multiple (unrelated) payloads into one alert nikns (Jul 21)
- Re: snort mixes multiple (unrelated) payloads into one alert Frank Knobbe (Jul 21)
- Re: snort mixes multiple (unrelated) payloads into one alert Jason (Jul 23)
- Re: snort mixes multiple (unrelated) payloads into one alert Jason Haar (Jul 23)
- Re: snort mixes multiple (unrelated) payloads into one alert Frank Knobbe (Jul 24)
- Re: snort mixes multiple (unrelated) payloads into one alert Jason Brvenik (Jul 24)
- Re: snort mixes multiple (unrelated) payloads into one alert Martin Roesch (Jul 24)
- Re: snort mixes multiple (unrelated) payloads into one alert Eric J. Bowser (Jul 24)
- Re: snort mixes multiple (unrelated) payloads into one alert Jason Brvenik (Jul 24)
- Re: snort mixes multiple (unrelated) payloads into one alert nikns (Jul 21)
- Re: snort mixes multiple (unrelated) payloads into one alert Gentoo-Wally (Jul 21)