Re: What is the relationship between flow: and stream4_reassemble?

[Brian Caswell <bmc () snort org>]

On Jan 7, 2005, at 10:24 PM, Jason Haar wrote:
> Can someone spell out to me the relationship between the "flow:" 
> option and the stream4 preprocessor?
>
> What concerns me is what happens when I (say) have a rule that alerts 
> on "flow:..." traffic to port 42 - but stream4_reassemble doesn't 
> reassemble port 42? If the answer is "it wouldn't do what you expect", 
> then are the current rules affected by this, and if so, shouldn't some 
> sanity check be implemented to stop that happening (e.g "warning, flow 
> keyword found in rule using port 'any'"...)

It works just as you would expect.  flow only checks tcp state.  tcp 
state is tracked on all tcp ports.  TCP streams are reassembled only on 
the ports listed in stream4_reassemble.

Brian



-------------------------------------------------------
The SF.Net email is sponsored by: Beat the post-holiday blues
Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users