Re: libnids tcp reassembly

Jose Nazario <[email protected]> Mon, 11 Oct 2004 12:54:59 -0400 (EDT)

Newsgroups	gmane.comp.security.libnet
Message-ID	<[email protected]>

don't forget to set stream->client.collect = 1, and stream->server.collect
= 1 in your TCP callback when the state NIDS_JUST_ESTABLISHED is set.
without it you'll have no data to speak of.

i introduced libnids this past week in malaysia at HitB 2004. slides are
here, you guys get a sneak peak:

	http://monkey.org/~jose/presentations/hitb04-tools.d/

talk covered libdnet, libpcap, libnids and libevent. ie packet mastering
...

________
jose nazario, ph.d.			[email protected]
http://monkey.org/~jose/ 		http://infosecdaily.net/