Snort mailing list archives
Re: Tagged packets
From: Dirk Geschke <Dirk_Geschke () genua de>
Date: Tue, 30 Aug 2005 15:31:04 +0200
Hi Hin,
I'm receiving tagged packets but interesting enough, it doesn't come from signatures with a tag parameter. Now, I have searched the archive and there are numerous answers on this question. Is there an official answer on this question? Stream4, unified output plugin, what is it? Is there a way to fix this?
what do you mean with fix? Snort reassembles fragmented packets, with TCP this is done in stream4. So finally the full packet gets there reassembled to a bigger one. The unified output plugin decomposes this big packet in the original smaller one (although the individual headers are lost). If you like to use the full packet instead of the smaller tagged ones you should simply use another output plugin. (Or remove the decomposition of the big packet in the unified output plugin.) But this works as designed, so why (or how) should it be fixed? Best regards Dirk ------------------------------------------------------- SF.Net email is Sponsored by the Better Software Conference & EXPO September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Tagged packets Hin (Aug 30)
- Re: Tagged packets Dirk Geschke (Aug 30)