Commit graph

3 commits

Author SHA1 Message Date
Robin Sommer
a3e1dd5261 Merge remote branch 'origin/topic/gregor/reassmbler-hotfix'
Closes #404.

* origin/topic/gregor/reassmbler-hotfix:
  TCP Reassembler hotfix for conns > 2GB.
2011-02-25 10:54:43 -08:00
Gregor Maier
a5632aff4e TCP Reassembler hotfix for conns > 2GB.
The TCP Reassembler does not deliver any data to analyzers after the
first 2GB due to signed integer overflow (Actually it will deliver again
between 4--6GB, etc.) This happens silently, i.e., without content_gap
events or Undelivered calls.

See Comments in TCP_Reassembler.cc for more details.

As a hotfix that seems to work I disabled the seq_to_skip features. It
wasn't used by any analyzer or policy script (Note, that seq_to_skip is
different from skip_deliveries).

See also ticket #348
2011-01-12 09:38:13 -08:00
Robin Sommer
61757ac78b Initial import of svn+ssh:://svn.icir.org/bro/trunk/bro as of r7088 2010-09-27 20:42:30 -07:00