Re: Anomalous packet logged by Snort

[Chris Green <cmg () sourcefire com>]

Bill McCarty <bmccarty () apu edu> writes:
> Also, the QUIT followed by a PASS seems odd. And, the presence of a
> host name in the PASS doesn't seem right, especially when no delimiter
> separates the host name from the keyword PASS. That just can't be.

It's just how TCP Stream reassembly works right now.  We plop a lot of
packets together into a fake packet and inject it back through the
detection engine.
-- 
Chris Green <cmg () sourcefire com>
To err is human, to moo bovine.


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users