Re: stream4's new config

[Jason Brvenik <jasonb () sourcefire com>]

zhaohui yin wrote:
> while i read the snort source, I found some new config the stream4
> preprocessor had support ,but those config can't find any description
> in the manual.
>
> preprocessor stream4:midstream_drop_alerts

Should sessions that appear to not be fully established but have
alertable data be raised to the user or not. In general the answer would
be no ( Think stateless user DoS ) but if you want to see events that
would be generated then set this config option.

> preprocessor stream4_reassemble:  flush_behavior < default| random |
> large_window >,flush_seed <seed>,flush_base <base>,flush_range <range>

These config options control the boundaries that the stream preprocessor
flushes reassembled data on. The options are documented in the default
snort.conf with relevant bits copied here.

#   flush_behavior [mode] -
#           default      - use old static flushpoints (default)
#           large_window - use new larger static flushpoints
#           random       - use random flushpoints defined by flush_base,
#                          flush_seed and flush_range
#   flush_base [number] - lowest allowed random flushpoint (512 by default)
#   flush_range [number] - number is the space within which random
flushpoints are generated (default 1213)
#   flush_seed [number] - seed for the random number generator, defaults
to Snort PID + time



> who can tell the above config's means.
> --
> yinzhaohui
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by the JBoss Inc.  Get Certified Today
> Register for a JBoss Training Course.  Free Certification Exam
> for All Training Attendees Through End of 2005. For more info visit:
> http://ads.osdn.com/?ad_idv28&alloc_id845&op=click
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=ort-users


-------------------------------------------------------
This SF.Net email is sponsored by the JBoss Inc.  Get Certified Today
Register for a JBoss Training Course.  Free Certification Exam
for All Training Attendees Through End of 2005. For more info visit:
http://ads.osdn.com/?ad_id=7628&alloc_id=16845&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users