Session mixup by stream4

["gupta_sonali" <gupta_sonali () indiatimes com>]

Hi 


I came across this post in the neohapsis archives, which discusses an issue similar to what I seem to be facing. 


It is at: 


http://archives.neohapsis.com/archives/snort/2003-01/0858.html 


http://archives.neohapsis.com/archives/snort/2003-01/0872.html 


The discussion talks about a session payload mixup in data captured by snort. I am also facing this issue in some 
sessions that I get from snort. I am using snort 2.0 and snort 2.3 ORC2, and found the issue in both versions. Chris 
mentioned in the post that the issue has been fixed in HEAD CVS. The discussion was about version 1.9.0. Since I am 
using a newer version of snort, could you please tell me if the same fix has been applied to the newer versions, or is 
there some update I need to get to fix it. 
In order to figure out the session mix up issue, I did the following
a)       Ran two snorts simultaneously Snort-A and Snort-B. The Snort-A captures the traffic and dumps it in a tcpdump 
format, using the b option and Snort-B creates the sessions real time.
b)       Then I ran Snort-C (same executable as of Snort-B), which created session from the tcpdump produced by 
Snort-A. I found that the sessions created by Snort-C for the problematic ones were not identical to the sessions 
created by Snort-B and I also noticed that the sessions created by Snort-C has lesser number of session mixups. 
I also noted that some sessions created by Snort-B, which appeared incomplete (data from last one or two packets were 
missing) were fully formed when created by Snort-C. 
Is there any difference between the session reassemble real time and session reassemble using r option. 
During the test, we had tweaked Snort-B a bit so that it dumps all the sessions that are reassembled. We did this by 
hard coding gotevent = 1 and commenting the call to the preprocessor function in FlushStream function of ssp_stream4.c.
//        gotevent = Preprocess(stream_pkt);  //Commented
          gotevent = 1;        



 


Regards 
Sonali Gupta