Re: Regarding Snort and HTTP2

["Hui Cao (huica)" <huica () cisco com>]

Hi James,

Thanks for the email! We are working on http2 support experimental release in the near future. This will be based on 
the latest standard https://tools.ietf.org/html/rfc7540

I don't know the layering violations issue for http2 either. SETTINGS_CURRENT_CWND is used by SPDY.

Since one TCP session can serve many http2 streams, we use stream id to differentiate them.

Best,
Hui.
From: James McLaughlin <jmclaughlin () maxeler com<mailto:jmclaughlin () maxeler com>>
Date: Thursday, April 14, 2016 at 9:40 AM
To: "snort-devel () lists sourceforge net<mailto:snort-devel () lists sourceforge net>" <snort-devel () lists 
sourceforge net<mailto:snort-devel () lists sourceforge net>>
Subject: [Snort-devel] Regarding Snort and HTTP2

To follow on from the recent emails regarding Snort and HTTP/2, (and to go a little off-topic):

Poul Henning-Kamp and various other people claim that HTTP/2 has layering violations, but don't elaborate on what these 
are.

I thought this might be related to the SETTINGS_CURRENT_CWND setting, but apparently this was ditched in 2013.

Can someone on this list advise me on where to find some information on this? More importantly - and now I'm definitely 
back ON topic - does anyone know if these layering violations can interfere in any way with Snort's TCP session 
tracking?

Thanks,

James McLaughlin.

------------------------------------------------------------------------------
Find and fix application performance issues faster with Applications Manager
Applications Manager provides deep performance insights into multiple tiers of
your business applications. It resolves application problems quickly and
reduces your MTTR. Get your free trial!
https://ad.doubleclick.net/ddm/clk/302982198;130105516;z

_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel
Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel

Please visit http://blog.snort.org for the latest news about Snort!