Hi,
What about fragmented packets that never defragmented and
"out-of-order" sequence number packets? The reason I raised this
question is there are some attacks not detected because sometimes
packets are not passed down to the dectection engine.
Thanks,
Tung.
On Tue, Jul 15, 2008 at 10:02 PM, Joel Esler <joel.esler@mac.com> wrote:
I could be wrong on this, but I can't think of a scenario where a packet
would pass through frag3 or stream5 and get stopped. Unless the engine told
it to stop. (Like the SSL preprocessor instructed stream5 to not reassemble
an encrypted stream or something). Or if you had stream5 set up to force a
3 way handshake or something. Something in an inline deployment that
stopped a packet midstream.
But normally, yes, all packets should get passed down to the Detection
Engine. Why? Are experiencing a problem?
J
On Jul 15, 2008, at 8:37 PM, tung tran wrote:
It seems that nobody cares about questions raised by Snort-user or no
one knows about this??? This is my fifth post and still not a reply
yet.
On Fri, Jul 11, 2008 at 4:46 AM, tung tran <tunghack@gmail.com> wrote:
Hi all,
Could anyone please let me know after a packet is examined by Frag3 and
Stream5, is the packet always passed down to the Detection Engine? If
not, in which case a packet is not passed down to the Detection
Engine?
Thank you very much.
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's
challenge
Build the coolest Linux based applications with Moblin SDK & win great
prizes
Grand prize is a trip for two to an Open Source event anywhere in the
world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
