Re: can you define stream reassembly in a rule?

[phez asap via Snort-users <snort-users () lists snort org>]

THat is what I was thinking. Thanks for the info.



On Tue, Nov 27, 2018 at 12:54 PM Carter Waxman (cwaxman) <cwaxman () cisco com>
wrote:

> You probably won’t get the result you are looking for. Stream needs to
> gather enough state to reassemble a PDU and it likely won’t happen
> midstream + in a single packet (seq/ack analysis or PAF for instance). If
> some of the PDU you wanted to capture occurred in a prior wire packet,
> stream would not have saved it so it’s probably too late to run your full
> content. stream_reassemble is most useful in performing actions for the
> sake of future traffic, no the current traffic, so reassembling by
> snort.conf might be a better option.
>
>
>
> - Carter
>
> *From: *Snort-users <snort-users-bounces () lists snort org> on behalf of
> phez asap via Snort-users <snort-users () lists snort org>
> *Reply-To: *phez asap <phez.asap () gmail com>
> *Date: *Tuesday, November 27, 2018 at 1:14 PM
> *To: *"snort-users () lists snort org" <snort-users () lists snort org>
> *Subject: *[Snort-users] can you define stream reassembly in a rule?
>
>
>
> Is it possible to define stream reassembly in a rule to take place before
> a content statement (I am guessing no but thought I would ask)?  Something
> like stream_reassemble:enable,both rule option?
>
>
>
> Ex: If an incoming packet is going to a given IP address and given port
> reassemble it before content matching.
>
>
>
> I know normally for the stream5 preprocessor to reassemble a stream the
> port needs to be defined in the snort.conf file under
>
> preprocessor stream5_tcp: "ports client" or "ports both" config.
>
>
>
> Thanks,
_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

        To unsubscribe, send an email to:
        snort-users-leave () lists snort org

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette