hi,
How long does Bro keep ip-fragments ? The ip rfc tells:
The maximum this timer value could reach is the maximum time to live
(approximately 4.25 minutes). The current recommendation for the
initial timer setting is 15 seconds. This may be changed as the
experience with this protocol accumulates.
Considering resource constraints does bro keep the fragments for shorter
time ? Looking through Frag.cc,Sessions.cc i could'nt track where that
timer portion of code comes.(if anyone could point it)
Any pointers is appreciated.
- thanks
Ashley