Re: firestorm question

[rmkml <rmkml@xxxxxxxxxx>]

and other question:
if tcp session is established,
but no data before closed ...




rmkml wrote:

> Gianni Tedesco wrote:
>
> > On Tue, 2003-03-25 at 17:20, rmkml wrote:
> > > How track tcp session and if session is not full open (Syn-SynAck-Ack) and my
> > > box send tcp Reset ...
> >
> > flow:!established; ?
> >
> > > More complicated in udp proto ....
> >
> > true, need a way of tracking UDP 'connections' so that if packet goes
> > from A -> B, then traffic from B -> A will be considered 'established'
> > and ICMP traffic as 'related'. That would be easy enough but at the
> > moment I'm not spending too much time implementing features that aren't
> > part of the snort rulesets as they will only find limited use...
>
> like netfilter/iptable on linux ...