The midstream_drop_alerts is for the inline feature set, basically
what happens is when you drop a packet, the client retransmits the
dropped packet over and over again because it believes that the packet
was lost in transit. During the retransmission the stream4 session
may timeout so while in InlineMode we still need to inspect data on
sessions stream4 considers unestablished. The default behavior is to
sdrop these alerts. by enabling midstream_drop_alerts you would see
these midstream alerts. Think of it as cheap protection against
snot/stick attacks for InlineMode().
Regards,
Will
On 11/17/05, zhaohui yin <yinzhaohui@gmail.com> wrote:
while i read the snort source, I found some new config the stream4
preprocessor had support ,but those config can't find any description
in the manual.
preprocessor stream4:midstream_drop_alerts
preprocessor stream4_reassemble: flush_behavior < default| random |
large_window >,flush_seed <seed>,flush_base <base>,flush_range <range>
who can tell the above config's means.
--
yinzhaohui
-------------------------------------------------------
This SF.Net email is sponsored by the JBoss Inc. Get Certified Today
Register for a JBoss Training Course. Free Certification Exam
for All Training Attendees Through End of 2005. For more info visit:
http://ads.osdn.com/?ad_idv28&alloc_id845&opclick
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?listsnort-users
-------------------------------------------------------
This SF.Net email is sponsored by the JBoss Inc. Get Certified Today
Register for a JBoss Training Course. Free Certification Exam
for All Training Attendees Through End of 2005. For more info visit:
http://ads.osdn.com/?ad_idv28&alloc_id845&opÌk
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list
