Inline Normalization with Snort 2.9.0
Summary: Snort 2.9.0 adds a new preprocessor for inline deployments that normalizes packets and streams so Snort models end systems more accurately. The examples show TTL normalization raising a packet's TTL from 4 to 8 when the minimum is set to 5, and TCP stream normalization overwriting overlapping retransmitted segments so the server reassembles the stream only one way.
Bottom line: Without stream normalization, overlapping segments at relative sequence numbers 6 through 10 would reach the server twice, and what the application receives depends on that server's implementation-specific TCP reassembly policy - a difference an attacker can exploit and a defender cannot control.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026