mailing list archives
Re: Snort Supports SCTP
From: Joshua Kinard <kumba () gentoo org>
Date: Mon, 20 May 2013 13:52:01 -0400
On 05/20/2013 1:20 AM, Joshua Kinard wrote:
On 05/16/2013 7:53 AM, Russ Combs wrote:
It is on our radar, but there are no specific plans at this point.
On Wed, May 15, 2013 at 5:06 AM, marwane azzouzi
<azzouzi.marwane () hotmail fr> wrote:
My question concerns the support of the SCTP protocol by Snort in a mobile
I see that there is no preprocessor to decode the SCTP protocol such like
SIP or HTTP preprocessors...
Did the team intend to develop that feature?
Any information ?
Try the attached. I have a strange fascination with SCTP, so back in 2011,
I copied the Stream5 UDP code and made a very generic SCTP Stream5 module,
as well as duplicated all the code points where UDP was parsed to parse
SCTP. I also added a DecodeSCTP function and various helpers to decode.c,
and other bits that I'm not going to enumerate here. I just updated all the
code today to work with snort-18.104.22.168, and tested it on both IPv4 and
IPv6-based packet captures that I managed to hunt down off of Google.
Oops, I almost forgot to mention, I have a bunch of raw printf() statements
left over in decoder.c from debugging. Remove those if they get too
annoying with the supplied patch (to be added after the first two). I've
only tested this code on the handful of SCTP packet captures off of Google,
as I do not have a real SCTP setup to generate live traffic.
kumba () gentoo org
"The past tempts us, the present confuses us, the future frightens us. And
our lives slip away, moment by moment, lost in that vast, terrible in-between."
--Emperor Turhan, Centauri Republic
Description: OpenPGP digital signature
AlienVault Unified Security Management (USM) platform delivers complete
security visibility with the essential security capabilities. Easily and
efficiently configure, manage, and operate all of your security controls
from a single console and one unified framework. Download a free trial.
Snort-devel mailing list
Snort-devel () lists sourceforge net
Please visit http://blog.snort.org for the latest news about Snort!