How to Reassemble the Whole TCP Stream

Dear All:

Hello, I am new to Snort and would appreciate your assistance.

In each session, our client will send up to 10kB TCP data to our server at once. However, when dealing with these data, Snort combines the packets into several fragments of sizes from 0.5kB to 6kB instead of reassembling the whole 10kB data. The logs from the Stream5 and our instrumented PCRE library all confirmed the size of fragments. If a vulnerable command appear across 2 such fragments, Snort will miss it.
Is these any method to let snort reassemble the data of the whole session?

Here is my configuration file:

```
preprocessor stream5_global: track_tcp yes, max_tcp 2621440, memcap 83886080, show_rebuilt_packets
preprocessor stream5_tcp: timeout 30, \
    policy first, \
    max_queued_bytes 10485760, \
    max_queued_segs 26210, \
    ports server 22 10002
include test.rules
```

Here is my rules file:

```
alert tcp any any -> any 10002 (msg:"MKDIR at root detected"; stream_reassemble:enable,both; content:"MKDIR"; pcre:"/MKDIR\s+\/[^\/]+\s/smi"; sid:11451; rev:2;)
```

To avoid packet loss, I have configured `ethtool` according to https://www.snort.org/documents/possible-packet-loss-during-reassembly-for-snort-ids-ips-sensors

And my command to run Snort:

```
snort -i eth0 -c test.conf -l log -A full -k none --snaplen 65535
```

Thanks
Yichen Liu
_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette