IDS mailing list archives

TCP Sack processing

From: snort user <snort.user () gmail com>
Date: Tue, 9 Aug 2005 16:28:10 -0400

Greetings.

Does TCP stream reassembly algorithm need TCP SACK processing for completeness ?
Are there scenarios that an IDS/IPS would miss an attack if it does
not take the selective acks into consideration.

Any comments/opinions/pointers is appreciated.

Thanks

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------

Current thread:

TCP Sack processing snort user (Aug 09)
- Re: TCP Sack processing Krzysztof Cabaj (Aug 10)
- Re: TCP Sack processing Joachim Schipper (Aug 12)
  - Re: TCP Sack processing Joel Esler (Aug 13)
    - Re: TCP Sack processing Martin Roesch (Aug 14)
  - Re: TCP Sack processing snort user (Aug 13)