Re: [Snort-devel] extend rules options to check tcp win size

m.stiefenhofer@ecofis.de writes:

> Hi Neal,

alert tcp $HOME_NET any -> $EXTERNAL_NET \ (msg: "OUTGOING possibly infected host"; window: 55808;)
>
> I'm no developer but I guess the best place for this is snort.c ?!

close. you could add it to snort.conf :)

-- 
Chris Green 
A watched process never cores.


-------------------------------------------------------
This SF.Net email is sponsored by: INetU
Attention Web Developers & Consultants: Become An INetU Hosting Partner.
Refer Dedicated Servers. We Manage Them. You Get 10% Monthly Commission!
INetU Dedicated Managed Hosting 
http://www.inetu.net/partner/index.php
_______________________________________________
Snort-devel mailing list
Snort-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-devel