Re: Questions about Frag3 and Stream5

["tung tran" <tunghack () gmail com>]

Hi,
What about fragmented packets that never defragmented and
"out-of-order" sequence number packets? The reason I raised this
question is there are some attacks not detected because sometimes
packets are not passed down to the dectection engine.
Thanks,
Tung.

On Tue, Jul 15, 2008 at 10:02 PM, Joel Esler <joel.esler () mac com> wrote:
> I could be wrong on this, but I can't think of a scenario where a packet
> would pass through frag3 or stream5 and get stopped.  Unless the engine told
> it to stop. (Like the SSL preprocessor instructed stream5 to not reassemble
> an encrypted stream or something).  Or if you had stream5 set up to force a
> 3 way handshake or something.  Something in an inline deployment that
> stopped a packet midstream.
>
> But normally, yes, all packets should get passed down to the Detection
> Engine.  Why?  Are experiencing a problem?
>
> J
>
>
> On Jul 15, 2008, at 8:37 PM, tung tran wrote:
>
> > It seems that nobody cares about questions raised by Snort-user or no
> > one knows about this??? This is my fifth post and still not a reply
> > yet.
> >
> > On Fri, Jul 11, 2008 at 4:46 AM, tung tran <tunghack () gmail com> wrote:
> > > Hi all,
> > > Could anyone please let me know after a packet is examined by Frag3 and
> > > Stream5, is the packet always passed down to the Detection Engine? If
> > > not, in which case a packet is not passed down to the Detection
> > > Engine?
> > > Thank you very much.
> >
> > -------------------------------------------------------------------------
> > This SF.Net email is sponsored by the Moblin Your Move Developer's
> > challenge
> > Build the coolest Linux based applications with Moblin SDK & win great
> > prizes
> > Grand prize is a trip for two to an Open Source event anywhere in the
> > world
> > http://moblin-contest.org/redirect.php?banner_id=100&url=/
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users