Re: Re: snort sees no fragmented attack

[Chris Green <cmg () sourcefire com>]

Holger.Woehle () arcor net writes:

> > echo "GET /aaaaaaa/aaa/aaaaa/aaaaaaaa/aaaaaaa/bcc/bin/ps" | nc
>
> Hello, i forgot to tell you some Version numbers : I am using Snort
> 1.8.7 also tested it with 1.9 beta 2 and Linux 2.4.18 Intel Pentium
> 4 2GHZ 256 MByte RAM.  The Sensor listens behind a Shomiti Ethernet
> TAP.  May this be the problem ?  The Sensor only catches the
> "incoming" traffic. I do not want the answers from the machines.  Am
> i wrong with that ? Does snort neeed the outgoing traffic for defrag
> ?


Well, in 1.9 w/ a 1.9 ruleset, you should turn on

preprocessor stream4: asynchronous_link

you are running into the state machines actually caring about the
state of a TCP session which it can't ascertain w/o haivng both sides
of the conversation.

This is not related to fragmentation.
-- 
Chris Green <cmg () sourcefire com>
A good pun is its own reword.


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users