Re: [Snort-users] Tagged packets

Hi Hin,

> I'm receiving tagged packets but interesting enough, it doesn't come from 
> signatures with a tag parameter. Now, I have searched the archive and there 
> are numerous answers on this question. Is there an official answer on this 
> question? Stream4, unified output plugin, what is it? Is there a way to fix 
> this?

what do you mean with fix?

Snort reassembles fragmented packets, with TCP this is done in stream4.
So finally the full packet gets there reassembled to a bigger one.

The unified output plugin decomposes this big packet in the original
smaller one (although the individual headers are lost).

If you like to use the full packet instead of the smaller tagged
ones you should simply use another output plugin. (Or remove the
decomposition of the big packet in the unified output plugin.)

But this works as designed, so why (or how) should it be fixed?

Best regards

Dirk



-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users