Re: [Snort-users] Content string search across packets

At 04:39 PM 4/29/2004, sowdambiga karthikeyan wrote:
> I have a general question about the content string search in snort.
> Does snort
>support searching for a string across multiple packets. For eg. can we search
>for a string "ABCDEF" where "ABC" is present in one packet and "DEF" is
>present
>in the next packet.

Depends on what kind of packet you're talking about.

If it's TCP, and no actual data is sent back by the other end in between,
then in general stream4 should cover you there with no special effort.
Stream4 will re-assemble packets of a TCP stream up into hunks and run them
down at least 2 packets at a time, and more than 2 at a time if the packets
are small.

With tcp you run into trouble when people try do do things like look for
"abc" and then try to find "def" 20k later in the data stream. Stream4
doesn't work in such a way that you can search an entire tcp session as if
it were one gigantic packet, you're pretty much limited to about 3k of data
at most.

If you're talking udp packets, or there's some kind of acknowledgement in
between, then you'll need to use tagging to allow you to chain two separate
rules together to generate an alert.






-------------------------------------------------------
This SF.Net email is sponsored by: Oracle 10g
Get certified on the hottest thing ever to hit the market... Oracle 10g.
Take an Oracle 10g class now, and we'll give you the exam FREE.
http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users