問題文
The rule language offers two extra values beside the one for the transport protocol of a session. A hunter wants a rule to fire on a string that the sender splits across two packets. Which of the two fits, and why?
選択肢
- A third value beside the two, because a string that is split across packets is matched by a keyword that names the buffer instead of them.
- The one for the reassembled flow, because the other acts upon the content of a single packet on its own.
- The one for the single packet, because the other acts upon the content of the reassembled flow and holds the rule back until the session closes.
- Either of these, because the engine puts the pieces back together before it applies whichever of them the signature carries.