Snort mailing list archives
how to set paf_max unlimited to get all of the http response between <html> and </html> in single stream
From: Qasim Javed <qasim.javed () ebryx com>
Date: Thu, 3 Dec 2015 15:30:13 +0500
Hi. I have enabled TCP reassembly in snort.conf and have *set paf_max to 63780 *but my pcap to be analyzed contains response of bytes greater than 100000 and we can find two contents which must come in 63780 but my *content_no.1* is in first *63780* and *content_no.2* is in 2nd chunk of bytes got after flushing.So my rule is not generating alert, how can i fix this issue and make it unlimited. I have attached *snort.conf*. Best Regards, Qasim Javed| Malware Researcher | Ebryx (Pvt.) Ltd. | Office #1, 4th Floor Arfa STP, 346-B Ferozpur Road Lahore, Pakistan
Attachment:
snort.conf
Description:
------------------------------------------------------------------------------ Go from Idea to Many App Stores Faster with Intel(R) XDK Give your users amazing mobile app experiences with Intel(R) XDK. Use one codebase in this all-in-one HTML5 development environment. Design, debug & build mobile apps & 2D/3D high-impact games for multiple OSs. http://pubads.g.doubleclick.net/gampad/clk?id=254741911&iu=/4140
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- how to set paf_max unlimited to get all of the http response between <html> and </html> in single stream Qasim Javed (Dec 03)