Re: stream4's new config

[Will Metcalf <william.metcalf () gmail com>]

The midstream_drop_alerts is for the inline feature set, basically
what happens is when you drop a packet, the client retransmits the
dropped packet over and over again because it believes that the packet
was lost in transit.  During the retransmission the stream4 session
may timeout so while in InlineMode we still need to inspect data on
sessions stream4 considers unestablished.  The default behavior is to
sdrop these alerts.  by enabling midstream_drop_alerts you would see
these midstream alerts.  Think of it as cheap protection against
snot/stick attacks for InlineMode().

Regards,

Will

On 11/17/05, zhaohui yin <yinzhaohui () gmail com> wrote:
> while i read the snort source, I found some new config the stream4
> preprocessor had support ,but those config can't find any description
> in the manual.
>
> preprocessor stream4:midstream_drop_alerts
>
> preprocessor stream4_reassemble:  flush_behavior < default| random |
> large_window >,flush_seed <seed>,flush_base <base>,flush_range <range>
>
>
> who can tell the above config's means.
> --
> yinzhaohui
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by the JBoss Inc.  Get Certified Today
> Register for a JBoss Training Course.  Free Certification Exam
> for All Training Attendees Through End of 2005. For more info visit:
> http://ads.osdn.com/?ad_idv28&alloc_id845&opclick
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?listsnort-users


-------------------------------------------------------
This SF.Net email is sponsored by the JBoss Inc.  Get Certified Today
Register for a JBoss Training Course.  Free Certification Exam
for All Training Attendees Through End of 2005. For more info visit:
http://ads.osdn.com/?ad_idv28&alloc_id845&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users