Content checking in reassembled packets

[bahamin takhtaei <b_takhtaei () yahoo com>]

Hi everybody,
I want to find a specific content in some reassembled TCP packets;

I add these rules to Snort:

alert tcp any 1:65535 -> any 1:65535 (msg:"content test"; flow:from_server, established; content:"cart directory"; 
sid:1000000;)
alert tcp any 1:65535 -> any 1:65535 (msg:"content test"; flow:from_server, only_stream; content:"cart directory"; 
sid:1000001;)
--------------------------------------------------------------------------

and I configure Stream4 in snort.conf:

preprocessor stream4: disable_evasion_alerts
preprocessor stream4_reassemble

Then send http traffic to the Snort-machine that contains the specific content.
(I capture the traffic and check its validity), but the rules are not trigger! Why please?!
(Notice: when the content set in a single packet Snort finds it)

Thanks.



------------------------------------------------------------------------------
This SF.net email is sponsored by:
SourcForge Community
SourceForge wants to tell your story.
http://p.sf.net/sfu/sf-spreadtheword

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users