Re: firestorm question

[rmkml <rmkml@xxxxxxxxxx>]

Gianni Tedesco wrote:

> On Tue, 2003-03-25 at 17:20, rmkml wrote:
> > How track tcp session and if session is not full open (Syn-SynAck-Ack) and my
> > box send tcp Reset ...
>
> flow:!established; ?
>
> > More complicated in udp proto ....
>
> true, need a way of tracking UDP 'connections' so that if packet goes
> from A -> B, then traffic from B -> A will be considered 'established'
> and ICMP traffic as 'related'. That would be easy enough but at the
> moment I'm not spending too much time implementing features that aren't
> part of the snort rulesets as they will only find limited use...

like netfilter/iptable on linux ...