Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Community Member

Definition of "MaxInspectLength" ?

Is MaxInspectLength measured from the beginning of the payload or the beginning of the packet including headers? Thanks -

--James

1 REPLY
Cisco Employee

Re: Definition of "MaxInspectLength" ?

In the case of TCP it is measured from the beginning of the TCP Stream. (mostly used in the STRING.TCP engine)

It takes the payloads from each packet in the TCP stream and concatenates them together and the sensor will then inspect the first bytes in the stream up till MaxInspectLength is reached.

So if the first packet has 50 bytes and the MaxInspectLength is less than 50 then only the data in the payload of this first packet in the stream will be inspected.

If, however, each packet has 5 bytes, and MaxInspectLength is set to 50. Then the payload from the the first 10 packets will be inspected until 50 bytes are inspected. The payloads from the additional packets in the stream will not be inspected.

In the case of UDP I believe it is from the beginning of the payload (STRING.UDP).

82
Views
0
Helpful
1
Replies
CreatePlease to create content