Re: [Snort-users] Tagged Packet

Hi Joel,

> The recommendation to disable stream4 is very bad :)

jipp, this is really a bad solution. But this will definitively
remove the tagged packets...

> Stream4 is not in charge of fragmentation, frag3 is.  Stream4 does  
> tcp conversation reconstruction.  If you disable Stream4 you will  
> render ALOT of rules totally null and void.

You can fragment IP packets on Layer 3, this is reassembled by frag3.
But you can also fragment on Layer 4, this is reassembled by stream4
by recreating the full session.

Think of telnet, is is not unlikely that every byte is sent by an
individual packet. (Before people ask, the "normal" telnet client
uses line buffering only on ports unequal to 23.)

To call this fragmentation or to reserve this to IP packets which 
got fragmented is another question...

Best regards

Dirk


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users