Re: Query on ClamAV preprocessor in snort-2.3.3

[Will Metcalf <william.metcalf () gmail com>]

ok, so just initialize clamav after "preprocessor stream4_reassemble"
in your snort.conf and viola, you are scanning the reassembled
streams.

Regards,

Will

On 5/15/05, Jason Haar <Jason.Haar () trimble co nz> wrote:
> I am now successfully using the ClamAV plugin, but there's one thing
> I've noticed. It appears that it works by dumping the data component of
> *single packets* out to disk and then runs clamav over it (not the
> binary - the library API of course). But it does look like single
> packets. This must mean there are tonnes of ClamAV signatures that don't
> get a chance to trigger.
>
> Assuming I am correct, is there a reason for this? I mean, snort itself
> "merges" multiple packets into streams, so why can't ClamAV code be
> called after the stream has been aggregated? And yes, I know snort
> doesn't reconstitute entire TCP conversations - but even 10 packets of a
> stream would be better than one?
>
> PS: yes  - you do need bigger CPUs. I have 16 systems in place and all
> ran below 0.6 load average. Now with ClamAV the busiest are running at
> 1.5 - i.e. I'll need to upgrade to faster hardware if I expect to really
> use this.
>
> --
> Cheers
>
> Jason Haar
> Information Security Manager, Trimble Navigation Ltd.
> Phone: +64 3 9635 377 Fax: +64 3 9635 417
> PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
>
> -------------------------------------------------------
> This SF.Net email is sponsored by Oracle Space Sweepstakes
> Want to be the first software developer in space?
> Enter now for the Oracle Space Sweepstakes!
> http://ads.osdn.com/?ad_id=7393&alloc_id=16281&op=click
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------
This SF.Net email is sponsored by Oracle Space Sweepstakes
Want to be the first software developer in space?
Enter now for the Oracle Space Sweepstakes!
http://ads.osdn.com/?ad_ids93&alloc_id281&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users