I have been looking around for clues on how to define rules, decoders or preprocessors to be able to content-inspect the TCP Header's Optional Data ( The last 0-40 bytes of the TCP Header)
Any clues? Is Snort even able to do that?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community