Re: TCP Sack processing

From: Martin Roesch (roesch_at_sourcefire.com)
Date: 08/14/05

  • Next message: Nakul Aggarwal: "Re: A possible HIPS? Was: Looking for HIDS-only products for XP/2000Pro" 
    Date: Sun, 14 Aug 2005 12:42:39 -0400
To: Joel Esler <eslerj@gmail.com>

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    On Aug 13, 2005, at 8:10 AM, Joel Esler wrote:

    > IIRC, Snort's preprocs do a very good job of keeping that state stuff
    > in combination between Stream4 and the new frag3. Basically this is
    > my opinion, and I need someone from SF to back me up.

    Snort's stream4 module is "clocked" by received ACKs from the
    receiving side of the connection, SACKs don't appear to me to
    influence our reassembly behavior because we typically don't want to
    process a collection of segments until we know that the other side of
    the connection has received them. I'd say that in the case of
    Snort's current stream reassembler, SACK processing isn't necessary.

         -Marty

    - --
    Martin Roesch - Founder/CTO, Sourcefire Inc. - +1-410-290-1616
    Sourcefire - Discover. Determine. Defend.
    roesch@sourcefire.com - http://www.sourcefire.com
    Snort: Open Source Network IDS - http://www.snort.org

    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.4.1 (Darwin)

    iD8DBQFC/3SCqj0FAQQ3KOARAv2sAJ92Rzmj+v87+Q7J+/GDpOoF4Ek3QgCeO91A
    715HSgpQYjQW71nmQ8sm9oo=
    =lNkK
    -----END PGP SIGNATURE-----

    ------------------------------------------------------------------------
    Test Your IDS

    Is your IDS deployed correctly?
    Find out quickly and easily by testing it
    with real-world attacks from CORE IMPACT.
    Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
    to learn more.
    ------------------------------------------------------------------------

  • Next message: Nakul Aggarwal: "Re: A possible HIPS? Was: Looking for HIDS-only products for XP/2000Pro"