Re: TCP Sack processing

[Martin Roesch <roesch () sourcefire com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Aug 13, 2005, at 8:10 AM, Joel Esler wrote:

> IIRC, Snort's preprocs do a very good job of keeping that state stuff
> in combination between Stream4 and the new frag3.  Basically this is
> my opinion, and I need someone from SF to back me up.

Snort's stream4 module is "clocked" by received ACKs from the  
receiving side of the connection, SACKs don't appear to me to  
influence our reassembly behavior because we typically don't want to  
process a collection of segments until we know that the other side of  
the connection has received them.  I'd say that in the case of  
Snort's current stream reassembler, SACK processing isn't necessary.

    -Marty


- --
Martin Roesch - Founder/CTO, Sourcefire Inc. - +1-410-290-1616
Sourcefire - Discover.  Determine.  Defend.
roesch () sourcefire com - http://www.sourcefire.com
Snort: Open Source Network IDS - http://www.snort.org


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (Darwin)

iD8DBQFC/3SCqj0FAQQ3KOARAv2sAJ92Rzmj+v87+Q7J+/GDpOoF4Ek3QgCeO91A
715HSgpQYjQW71nmQ8sm9oo=
=lNkK
-----END PGP SIGNATURE-----

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------