Re: Questions about Frag3 and Stream5

[Joel Esler <joel.esler () mac com>]

I could be wrong on this, but I can't think of a scenario where a  
packet would pass through frag3 or stream5 and get stopped.  Unless  
the engine told it to stop. (Like the SSL preprocessor instructed  
stream5 to not reassemble an encrypted stream or something).  Or if  
you had stream5 set up to force a 3 way handshake or something.   
Something in an inline deployment that stopped a packet midstream.

But normally, yes, all packets should get passed down to the Detection  
Engine.  Why?  Are experiencing a problem?

J


On Jul 15, 2008, at 8:37 PM, tung tran wrote:

> It seems that nobody cares about questions raised by Snort-user or no
> one knows about this??? This is my fifth post and still not a reply
> yet.
>
> On Fri, Jul 11, 2008 at 4:46 AM, tung tran <tunghack () gmail com> wrote:
> > Hi all,
> > Could anyone please let me know after a packet is examined by Frag3  
> > and
> > Stream5, is the packet always passed down to the Detection Engine? If
> > not, in which case a packet is not passed down to the Detection
> > Engine?
> > Thank you very much.
>
> -------------------------------------------------------------------------
> This SF.Net email is sponsored by the Moblin Your Move Developer's  
> challenge
> Build the coolest Linux based applications with Moblin SDK & win  
> great prizes
> Grand prize is a trip for two to an Open Source event anywhere in  
> the world
> http://moblin-contest.org/redirect.php?banner_id=100&url=/
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users