Re: Smb output

[Frank Knobbe <frank () knobbe us>]

On Wed, 2004-07-21 at 01:22, Nerijus Krukauskas wrote:
>    Smb alerting would be soooo sloooow, that snort would start 
> dropping packets very soon and very fast.

Is that really the case? Isn't the SMB alert just a single UDP packet?
If so, it would be comparable to a TCP reset packet. Does that slow
Snort down that much? Perhaps the SMB plugin just needs to be optimized
properly...

Regards,
Frank

Attachment: signature.asc
Description: This is a digitally signed message part