Re: Stream5 reassembly

[Joel Esler <jesler () sourcefire com>]

On Jun 1, 2010, at 6:05 AM, Parag Pote wrote:
> So Joel, Does this mean when somebody fetch HTTP page reassembly module assemble the complete HTTP page in a buffer, 
> scan for signatures on whole data? If the page is OK, flush the complete data?


Loosely speaking, yes.  That's one of the features of the Stream5 preprocessor.  I suggest a read of the README.stream5 
documentation in the doc/ directory of the tarball.

--
Joel Esler
302-223-5974
Jabber: jesler () sourcefire com


------------------------------------------------------------------------------

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users