[ossec-list] Re: windows file integrity question, ossec is great!

[Martin Leung]

Hi,

gentux

UDP being connectionless, I don't see how the client can possibly "know"
that the message was received; however, a modifiable threshold on the
server could possibly help with the issue.  For example, a setting in
the .conf file that tells it to expect 5 messages every 15 minutes,
otherwise send an alert (numbers complete subject to user
determination).  Of course, a better place for the setting would be in
the clients.conf file so that you can set these specs per client rather
than an overall setting for the server.

Sorry for interrupt but I've an idea on acknowledgement to share:

- Add an unique sequence ID to each message the client send.
- Define a threshold that the server has to acknowledge,
  e.g. every 100 messages
- client caches all unacknowledge message
- when the threshold is reached, client will resent all
  unacknowledge message
- Server acknowledges client with the last sequence number received
  occassionally

Rgds.
Martin

smime.p7s
Description: S/MIME Cryptographic Signature