Snort mailing list archives
Re: Questions about Frag3 and Stream5
From: "tung tran" <tunghack () gmail com>
Date: Tue, 15 Jul 2008 22:24:20 -0400
Hi, What about fragmented packets that never defragmented and "out-of-order" sequence number packets? The reason I raised this question is there are some attacks not detected because sometimes packets are not passed down to the dectection engine. Thanks, Tung. On Tue, Jul 15, 2008 at 10:02 PM, Joel Esler <joel.esler () mac com> wrote:
I could be wrong on this, but I can't think of a scenario where a packet would pass through frag3 or stream5 and get stopped. Unless the engine told it to stop. (Like the SSL preprocessor instructed stream5 to not reassemble an encrypted stream or something). Or if you had stream5 set up to force a 3 way handshake or something. Something in an inline deployment that stopped a packet midstream. But normally, yes, all packets should get passed down to the Detection Engine. Why? Are experiencing a problem? J On Jul 15, 2008, at 8:37 PM, tung tran wrote:It seems that nobody cares about questions raised by Snort-user or no one knows about this??? This is my fifth post and still not a reply yet. On Fri, Jul 11, 2008 at 4:46 AM, tung tran <tunghack () gmail com> wrote:Hi all, Could anyone please let me know after a packet is examined by Frag3 and Stream5, is the packet always passed down to the Detection Engine? If not, in which case a packet is not passed down to the Detection Engine? Thank you very much.------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Questions about Frag3 and Stream5 tung tran (Jul 11)
- Re: Questions about Frag3 and Stream5 tung tran (Jul 15)
- Re: Questions about Frag3 and Stream5 Joel Esler (Jul 15)
- Re: Questions about Frag3 and Stream5 tung tran (Jul 15)
- Re: Questions about Frag3 and Stream5 Nigel Houghton (Jul 16)
- Re: Questions about Frag3 and Stream5 Joel Esler (Jul 15)
- Re: Questions about Frag3 and Stream5 Jason Brvenik (Jul 16)
- Re: Questions about Frag3 and Stream5 tung tran (Jul 15)
- <Possible follow-ups>
- Re: Questions about Frag3 and Stream5 Andy Pace (Jul 15)