[Snort-devel] HTTP 100 messages seem to throw stream4

From: Dan O'Keefe <dan.okeefe(at)attbi.com>
Date: Fri Jun 27 2003 - 23:07:08 EDT

I have spent some time testing the stream4 reassembly as I cannot seem to get it to work in my environment. It meshes unrelated http packets together and dumps a stateful message on the wrong trigger so that the dumped, re-assembled message is meaningless. I have reached the conclusion that it seems the stream4 routine does not handle HTTP 100 Continue messages. These messages seem to be the break points that cause the mashed streams and early triggers. They contain no data and only maintain the ACK and SEQ numbers of the prior and upcoming packets. Unfortunately, I do not know the source code well enough to try and figure out how to fix this. Could someone run a test and confirm my hypothesis - and/or attempt a fix.

Thanks and regards,
Dan O'Keefe

---

This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100006ave/direct;at.asp_061203_01/01

---

Snort-devel mailing list
Snort-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-devel Received on Mon Jun 30 08:21:30 2003