Re: Newbie question

[Erek Adams <erek () theadamsfamily net>]

On Tue, 5 Mar 2002, Jhumri Tilayia wrote:

> Well, I assume that because it's a Network IDS, it sniffs packets. Will it
> let me (for example) write a rule that looks for certain HTTP requests,
> without specifying the whole IP packet (i.e. can it intelligently decode the
> protocol stack?). Since with TCP, a given request could be split across
> multiple packets, can it decode a whole stream (like Ethereal does)?

Have a look at the FAQ as it answers a lot of common questions.

http://www.snort.org/docs/faq.html#1.6
http://www.snort.org/docs/faq.html#3.14

Those two links pertain to your questions.

Cheers!

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users