Trivial question

[Reinoud Koornstra <sockstat () hotmail com>]

Dear Everyone,

 

When i run http traffic through snort, while snort is in inline mode and monitoring the sizeo of the packets, I see 
that every 4 of more full mtu packets a packet of 17k bytes is being processed by snort. I am seeing this with most 
kind of traffic, but not with ftp.

Is that correct or not?

Thanks,

 

Reinoud.

------------------------------------------------------------------------------
How ServiceNow helps IT people transform IT departments:
1. Consolidate legacy IT systems to a single system of record for IT
2. Standardize and globalize service processes across IT
3. Implement zero-touch automation to replace manual, redundant tasks
http://pubads.g.doubleclick.net/gampad/clk?id=51271111&iu=/4140/ostg.clktrk

_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel
Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel

Please visit http://blog.snort.org for the latest news about Snort!