[Snort-inline-users] iptstate for stream4: RELATED mistake?

[Victor J. <vi...@nk...>]

Hi Will, List,

I was thinking about the aproach and i think i've made a little mistake. 
The patch asumes only NEW connection can start a tcp-connection and 
ESTABLISHED and RELATED don't. However, if i'm not mistaken, RELATED 
connections can also set up connections. This is because RELATED takes 
care of the ftp-data connection for example, which is of-course a normal 
tcp connection. After the setting up of this RELATED connection, it 
becomes ESTABLISHED (i asume, correct me if i'm wrong). So basicly what 
i'm saying is that we should mark NEW,RELATED 0x10 and ESTABLISHED 0x11.

I will try to test this asap.

Regards,
Victor