[Bro] TCP Sack processing

Vern Paxson vern at icir.org
Tue Aug 9 13:32:49 PDT 2005


> Does TCP stream reassembly algorithm need TCP SACK processing for completeness ?

No.  SACKs are advisory, not guarantees, and can be ignored for purposes
of stream reassembly.

		Vern



More information about the Bro mailing list