https://inliniac.net/blog/tag/out-of-order/ Recent content in Out-of-Order on Inliniac Hugo en Mon, 30 Jul 2007 21:22:56 +0000 https://inliniac.net/blog/2007/07/30/snort_inline-and-out-of-order-packets/ Mon, 30 Jul 2007 21:22:56 +0000 https://inliniac.net/blog/2007/07/30/snort_inline-and-out-of-order-packets/ <p>In Snort_inline&rsquo;s stream4 modifications, one of the changes is that out of order TCP packets are treated differently from unmodified stream4. This can cause some new alerts to appear and some unexpected behaviour. So I&rsquo;ll try to explain what happens here.</p> <p>First of all let me explain quickly what out of order packets are. To put it simple, TCP packets are send out by the source host in a specific order but can arrive in a different order at the destination. Packetloss, link saturation, routing issues are among many things that can cause this. A Snort_inline specific issue is that when Snort_inline can&rsquo;t keep up with the packets it needs to process, it will drop packets which causes packetloss. These packets will then have to be resent by the sending host.</p>