Re: uricontent option in 1.9 vs 1.8.6

[Chris Green <cmg () sourcefire com>]

Brian <bmc () snort org> writes:

> > Can someone please explain to me why the rule for sid 1242 acts differently
> > in snort 1.8.6 vs. snort 1.9?
>
> <snip>
>
> > The following packet generates an alert when running Snort 1.8.6, but not
> > Snort 1.9
> >
> > 02/16-02:18:38.582833 217.234.56.78:3306 -> 123.456.78.90:80
> > TCP TTL:112 TOS:0x0 ID:43759 IpLen:20 DgmLen:1492 DF
> > ***AP*** Seq: 0xAEAD8723  Ack: 0xB2DB3D32  Win: 0x4410  TcpLen: 20
> > /default.ida?N

Now, we rely on stream reassembly a good bit more to ensure that that
/default.ida?NNN is now merged with the preceeding packet to give us a
full uri to alert on.
-- 
Chris Green <cmg () sourcefire com>
A good pun is its own reword.


-------------------------------------------------------
This SF.net email is sponsored by: Scholarships for Techies!
Can't afford IT training? All 2003 ictp students receive scholarships.
Get hands-on training in Microsoft, Cisco, Sun, Linux/UNIX, and more.
www.ictp.com/training/sourceforge.asp
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users