Frag3 and Stream5 Packet Reassembly for Both Windows and Linux

[Dave Spatz <davespatz () gmail com>]

Hello,

Question on if I can have a single snort instance reassemble packets both
for Windows and Linux at the same time. I know I can get around this by
running separate instances if I must (one specifying only Windows or Linux)
or specify certain IP's/subnets for which is Windows vs. Linux but I have a
huge mixed subnet of both Linux and Windows and keeping track of them will
be a management nightmare.


Therefore for frag3/stream5:

1. Does snort allow for this and assuming no, would this available in Snort
3.x?
2. I assume that if I just chose Windows, Linux signatures would fail to
match, correct?

Thank you very much to anyone who can reply.

Thanks

------------------------------------------------------------------------------
What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic
patterns at an interface-level. Reveals which users, apps, and protocols are 
consuming the most bandwidth. Provides multi-vendor support for NetFlow, 
J-Flow, sFlow and other flows. Make informed decisions using capacity 
planning reports. https://ad.doubleclick.net/ddm/clk/305295220;132659582;e

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!