Re: Regarding Snort and HTTP2

Hi James,

Thanks for the email! We are working on http2 support experimental release in the near future. This will be based on the latest standard https://tools.ietf.org/html/rfc7540

I don't know the layering violations issue for http2 either. SETTINGS_CURRENT_CWND is used by SPDY.

Since one TCP session can serve many http2 streams, we use stream id to differentiate them.

Best,
Hui.
From: James McLaughlin <[email protected]<mailto:[email protected]>>
Date: Thursday, April 14, 2016 at 9:40 AM
To: "[email protected]<mailto:[email protected]>" <[email protected]<mailto:[email protected]>>
Subject: [Snort-devel] Regarding Snort and HTTP2

To follow on from the recent emails regarding Snort and HTTP/2, (and to go a little off-topic):

Poul Henning-Kamp and various other people claim that HTTP/2 has layering violations, but don't elaborate on what these are.

I thought this might be related to the SETTINGS_CURRENT_CWND setting, but apparently this was ditched in 2013.

Can someone on this list advise me on where to find some information on this? More importantly - and now I'm definitely back ON topic - does anyone know if these layering violations can interfere in any way with Snort's TCP session tracking?

Thanks,

James McLaughlin.

------------------------------------------------------------------------------
Find and fix application performance issues faster with Applications Manager
Applications Manager provides deep performance insights into multiple tiers of
your business applications. It resolves application problems quickly and
reduces your MTTR. Get your free trial!
https://ad.doubleclick.net/ddm/clk/302982198;130105516;z

_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/snort-devel
Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel

Please visit http://blog.snort.org for the latest news about Snort!