Re: FP shows snort-2.9.0.3 confused over packets and sessions

[Jason Haar <Jason.Haar () trimble co nz>]

On 10/05/11 19:42, rmkml wrote:
> Hi Jason,
> I suggest replace `depth:4;` to `http_method;`.
> Replace it's work on my test.
> I have another suggest, replace `isdataat:200,relative;` to
> `isdataat:200,relative; content:!"|0A|"; within:200;`.
> I have another another suggest, on pcre, replace `(?!\n)` to `(?!\r?\n)`.

I think your suggested changes make a lot of sense, but that wasn't
really my point. Why did a "depth:4" rule match *inside* a stream
instead of the *beginning* of a stream?

> Please upgrade to snort v2.9.0.5.

Is there a stream5 bug in 2.9.0.3 that caused this? Changelog doesn't
show anything. My understanding of how snort merges packets into streams
is contradicted by this event: either my understanding is incorrect, or
there's a bug(?)

 

-- 
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1


------------------------------------------------------------------------------
Achieve unprecedented app performance and reliability
What every C/C++ and Fortran developer should know.
Learn how Intel has extended the reach of its next-generation tools
to help boost performance applications - inlcuding clusters.
http://p.sf.net/sfu/intel-dev2devmay
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users