Re: snort 2.1 and stream4

[Matt Kettler <mkettler () evi-inc com>]

At 02:24 PM 1/30/2004, snort user wrote:
> I have a rule that is supposed to detect something at the beginning and 
> the end of an email message. Since the email message may be rather large I 
> have stream4_reassemble enabled. The problem is the rule does not trigger. 
> If I break the rule into 2 rules one with each of the contents to look 
> for, both rules will trigger when it sees the email. Shouldn't stream4 
> reassemble a single email message  and my rule should fire?

No. stream4 won't work if the two content strings are separated by a large 
amount of data.. it's not designed to do that in the first place.

Stream4 will flush each time the server sends data back to the client. It 
also has memory caps, and will flush when it hits those.

The idea of stream4 is to prevent people from just sending a command that 
would fit into a single tcp segment using a bunch of small tcp segments. 
i.e. abusing the heck out of segmentation to make one packet look like many 
separate ones.

It's not intended to allow a rule to be run against massive quantities of 
data that would be separated by hundreds of tcp segments as a single lump.




-------------------------------------------------------
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.eclipsecon.org/osdn
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users