[Snort-users] What is the relationship between flow: and stream4_reassemble?

Can someone spell out to me the relationship between the "flow:" option 
and the stream4 preprocessor?

What concerns me is what happens when I (say) have a rule that alerts on 
"flow:..." traffic to port 42 - but stream4_reassemble doesn't 
reassemble port 42? If the answer is "it wouldn't do what you expect", 
then are the current rules affected by this, and if so, shouldn't some 
sanity check be implemented to stop that happening (e.g "warning, flow 
keyword found in rule using port 'any'"...)

i.e. I currently have 62 rules that have ports "any -> ... any ..." in 
them, and my stream4_reassemble: is set to the default ports of 21 23 25 
53 80 110 111 143 and 513. Will those rules work as expected?

--
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1



-------------------------------------------------------
The SF.Net email is sponsored by: Beat the post-holiday blues
Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users