-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On Aug 13, 2005, at 8:10 AM, Joel Esler wrote:
IIRC, Snort's preprocs do a very good job of keeping that state stuff
in combination between Stream4 and the new frag3. Basically this is
my opinion, and I need someone from SF to back me up.
Snort's stream4 module is "clocked" by received ACKs from the
receiving side of the connection, SACKs don't appear to me to
influence our reassembly behavior because we typically don't want to
process a collection of segments until we know that the other side of
the connection has received them. I'd say that in the case of
Snort's current stream reassembler, SACK processing isn't necessary.
-Marty
- --
Martin Roesch - Founder/CTO, Sourcefire Inc. - +1-410-290-1616
Sourcefire - Discover. Determine. Defend.
[EMAIL PROTECTED] - http://www.sourcefire.com
Snort: Open Source Network IDS - http://www.snort.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (Darwin)
iD8DBQFC/3SCqj0FAQQ3KOARAv2sAJ92Rzmj+v87+Q7J+/GDpOoF4Ek3QgCeO91A
715HSgpQYjQW71nmQ8sm9oo=
=lNkK
-----END PGP SIGNATURE-----
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------
