Re: stream4 - simple experiment

[Matt Kettler <mkettler () evi-inc com>]

At 10:26 AM 6/19/2003 -0400, CHARLES ASMUTH wrote:

> What do I need to do to get alerts for the client stream transmissions of 
> the string "xyz"?

Stream4 flushes the buffer every time the "flow" of data switches.. In your 
case it never catches the individual byte-by-byte echo back, because it's 
separated by traffic from the client. This is done to prevent stream4 from 
having to buffer and *entire* tcp session.. that could very quickly grow to 
several gigs of data as a single "uber packet" in the case of a file download.

The point is to re-assemble fragments of the same fundamental "data chunk" 
sent all at the same time to a server such as a mailserver, and flush 
whenever the mailserver responds.

If however the server were to send 3 packets "x" "y" "z" without a client 
data packet in between, the rule should fire. I'd suggest trying writing a 
shell script that does something like:

echo x
sleep 1
echo y
sleep 1
echo z

log in and execute that and see what happens.





-------------------------------------------------------
This SF.Net email is sponsored by: INetU
Attention Web Developers & Consultants: Become An INetU Hosting Partner.
Refer Dedicated Servers. We Manage Them. You Get 10% Monthly Commission!
INetU Dedicated Managed Hosting http://www.inetu.net/partner/index.php
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users