Re: established connection and ids signatures
"lola marais" <[email protected]>
| Newsgroups | gmane.comp.security.intrusions |
|---|---|
| Message-ID | <[email protected]> |
>This used to be accomplished with the -z switch. You might want to take >a look at deactivating the stream4 preprocessor in snort.conf, too. -z Set assurance mode, match on established sesions (for TCP) as far as i can see and understand, that seams to make it even more stateful >I'm >not really sure of the answer to Your question, though. Snort has become >a lot more stateful in the last few releases. _________________________________________________________________ Keep in touch with friends abroad - it's easy with MSN Groups! http://groups.msn.com/people.msnw?pgmarket=en-za _______________________________________________ Intrusions mailing list [email protected] http://www.dshield.org/mailman/listinfo/intrusions