4

I have been looking around for clues on how to define rules, decoders or preprocessors to be able to content-inspect the TCP Header's Optional Data ( The last 0-40 bytes of the TCP Header)

TCP Header

Any clues? Is Snort even able to do that?

Improve this question

1 Answer 1

Reset to default
2

Snort don't support to check tcp header length.

But if snort connecting to database, it can store optional data of ip and tcp.

enter image description here

Improve this answer

You must log in to answer this question.