snort-devel July 2008 archive
Main Archive Page > Month Archives  > snort-devel archives
snort-devel: Re: [Snort-devel] spp_conversation preprocessor

Re: [Snort-devel] spp_conversation preprocessor

From: Steven Sturges <steve.sturges_at_nospam>
Date: Mon Jul 28 2008 - 12:51:12 GMT
To: Adayadil Thomas <adayadil.thomas@gmail.com>


spp_conversation watched a list of allowed IP protocols and created session data, similar to what stream does now. It interacted with portscan2.

Both were last available with Snort 2.4.5.

 From what I recall, neither interacted with flow or clientserver (flow rule keyword).

Cheers.
-steve

Adayadil Thomas wrote:
> Greetings.
>
> I am aware that the spp_conversation preprocessor is deprecated,
> but can someone tell me what the purpose of this preprocessor was?
> Does this have any relation to flow? or sp_clientserver.c?
>
> Thanks
>
> -------------------------------------------------------------------------
> This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
> Build the coolest Linux based applications with Moblin SDK & win great prizes
> Grand prize is a trip for two to an Open Source event anywhere in the world
> http://moblin-contest.org/redirect.php?banner_id=100&url=/
> _______________________________________________
> Snort-devel mailing list
> Snort-devel@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-devel
>



This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/

Snort-devel mailing list
Snort-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-devel