Re: Content string search across packets

[Matt Kettler <mkettler () evi-inc com>]

At 04:39 PM 4/29/2004, sowdambiga karthikeyan wrote:
>   I have a general question about the content string search in snort. 
> Does snort
> support searching for a string across multiple packets. For eg. can we search
> for a string "ABCDEF" where "ABC" is present in one packet and "DEF" is 
> present
> in the next packet.

Depends on what kind of packet you're talking about.

If it's TCP, and no actual data is sent back by the other end in between, 
then in general stream4 should cover you there with no special effort. 
Stream4 will re-assemble packets of a TCP stream up into hunks and run them 
down at least 2 packets at a time, and more than 2 at a time if the packets 
are small.

With tcp you run into trouble when people try do do things like look for 
"abc" and then try to find "def" 20k later in the data stream. Stream4 
doesn't work in such a way that you can search an entire tcp session as if 
it were one gigantic packet, you're pretty much limited to about 3k of data 
at most.

If you're talking udp packets, or there's some kind of acknowledgement in 
between, then you'll need to use tagging to allow you to chain two separate 
rules together to generate an alert.






-------------------------------------------------------
This SF.Net email is sponsored by: Oracle 10g
Get certified on the hottest thing ever to hit the market... Oracle 10g. 
Take an Oracle 10g class now, and we'll give you the exam FREE. 
http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users