Re: Stream5 reassembly ports

[NIDS TEAM <nidsteam () gmail com>]

Hi waldo kitty

Thanks for your reply, although it does not yet kill my questions :-) I was
thinking that all packets that do not have either client port or server
port equal to the configured ones will not be handled by Stream5 at all.
Thus I would expect all packets to directly get forwarded without any
buffering. Or I do not know what you mean with your comment that they need
to get buffered anyways, what for?

So what is the exact meaning of 'ports client' and 'ports both' then? I
always thought of Stream5 as a 'pure' Reassembly module which only needs to
buffer packets in case they need to get reassembled.

thanks
guh


On Wed, May 28, 2014 at 8:22 AM, NIDS TEAM <nidsteam () gmail com> wrote:

> Hi
>
> Thanks for your reply, although it does not yet kill my questions :-) I
> was thinking that all packets that do not have either client port or server
> port equal to the configured ones will not be handled by Stream5 at all.
> Thus I would expect all packets to directly get forwarded without any
> buffering. Or I do not know what you mean with your comment that they need
> to get buffered anyways, what for?
>
> So what is the exact meaning of 'ports client' and 'ports both' then? I
> always thought of Stream5 as a 'pure' Reassembly module which only needs to
> buffer packets in case they need to get reassembled.
>
> thanks
> guh
------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and their 
applications. Written by three acclaimed leaders in the field, 
this first edition is now available. Download your free book today!
http://p.sf.net/sfu/NeoTech

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!