Snort mailing list archives
Re: HTTP reassembly problem
From: Russ Combs <rcombs () sourcefire com>
Date: Wed, 10 Oct 2012 17:05:05 -0400
On Wed, Oct 10, 2012 at 4:41 PM, waldo kitty <wkitty42 () windstream net>wrote:
On 10/10/2012 12:28, Russ Combs wrote: [...]You can also add show_rebuilt_packets to stream5_global and use with -Acmg tosee reassembled packets so you know how to tweak your rule.i'll bet that this is the option that João Lima is looking for... 1. will this also cause them to be logged in the file(s)??
No. This is strictly for debugging rules, etc.
2. what version of snort did this option first appear in?
Not sure, but it was long ago and far away.
------------------------------------------------------------------------------ Don't let slow site performance ruin your business. Deploy New Relic APM Deploy New Relic app performance management and know exactly what is happening inside your Ruby, Python, PHP, Java, and .NET app Try New Relic at no cost today and get our sweet Data Nerd shirt too! http://p.sf.net/sfu/newrelic-dev2dev _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
------------------------------------------------------------------------------ Don't let slow site performance ruin your business. Deploy New Relic APM Deploy New Relic app performance management and know exactly what is happening inside your Ruby, Python, PHP, Java, and .NET app Try New Relic at no cost today and get our sweet Data Nerd shirt too! http://p.sf.net/sfu/newrelic-dev2dev
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Re: HTTP reassembly problem, (continued)
- Re: HTTP reassembly problem Joel Esler (Oct 10)
- Re: HTTP reassembly problem João Lima (Oct 10)
- Re: HTTP reassembly problem Joel Esler (Oct 10)
- Re: HTTP reassembly problem Jason Brvenik (Oct 10)
- Re: HTTP reassembly problem João Lima (Oct 10)
- Re: HTTP reassembly problem Russ Combs (Oct 10)
- Re: HTTP reassembly problem João Lima (Oct 10)
- Message not available
- Re: HTTP reassembly problem João Lima (Oct 10)
- Re: HTTP reassembly problem beenph (Oct 10)
- Re: HTTP reassembly problem waldo kitty (Oct 10)
- Re: HTTP reassembly problem Russ Combs (Oct 10)
- Re: HTTP reassembly problem João Lima (Oct 11)
- Re: HTTP reassembly problem Russ Combs (Nov 08)