Snort mailing list archives
Re: preprocessor normalize_tcp: ips
From: Russ Combs <rcombs () sourcefire com>
Date: Mon, 9 Jan 2012 16:31:56 -0500
On Mon, Jan 9, 2012 at 12:18 PM, Jason Wallace <jason.r.wallace () gmail com>wrote:
Howdy, The manual states that if you set "preprocessor normalize_tcp: ips" that the ips option "ensure consistency in retransmitted data (also forces reassembly policy to "first"). Any segments that can't be properly reassembled will be dropped." Is this for streams or fragments?
Streams only.
Also, How does this affect later settings for stream5 and frag3? Does it make host specific settings irrelevant?
It only overrides the reassembly policy.
Thx, Wally ------------------------------------------------------------------------------ Ridiculously easy VDI. With Citrix VDI-in-a-Box, you don't need a complex infrastructure or vast IT resources to deliver seamless, secure access to virtual desktops. With this all-in-one solution, easily deploy virtual desktops for less than the cost of PCs and save 60% on VDI infrastructure costs. Try it free! http://p.sf.net/sfu/Citrix-VDIinabox _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
------------------------------------------------------------------------------ Ridiculously easy VDI. With Citrix VDI-in-a-Box, you don't need a complex infrastructure or vast IT resources to deliver seamless, secure access to virtual desktops. With this all-in-one solution, easily deploy virtual desktops for less than the cost of PCs and save 60% on VDI infrastructure costs. Try it free! http://p.sf.net/sfu/Citrix-VDIinabox
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- preprocessor normalize_tcp: ips Jason Wallace (Jan 09)
- Re: preprocessor normalize_tcp: ips Russ Combs (Jan 09)
- Re: preprocessor normalize_tcp: ips Jason Wallace (Jan 10)
- Re: preprocessor normalize_tcp: ips Russ Combs (Jan 10)
- Re: preprocessor normalize_tcp: ips Jason Wallace (Jan 10)
- Re: preprocessor normalize_tcp: ips Jason Wallace (Jan 10)
- Re: preprocessor normalize_tcp: ips Russ Combs (Jan 09)