Re: Snort On Windows - Major Announcement

[Joe McAlerney <joey () SiliconDefense com>]

Hello Michael,

The problem occurs when libnet_write_ip is called.  It fails when the
initial arp attempts to be sent via libnet_win32_send_arp.  I don't
believe the arp itself is the issue, but rather the fact that it is the
first packet to be sent out on the wire.  The result is a
PacketSendPacket error message from WinPcap.

I thought this may be a WinPcap issue, but given the current state of
LibnetNT and a testimonial from Frank, it's probably LibnetNT itself -
passing in bad parameters or what not.

We would like to contribute to any efforts to resolve this, but are not
in the position to take the entire task on ourselves.  It would probably
be a good idea to try your fixed version of LibnetNT to see if that
solves the problem.  If so, then all is well for now and we thank you
for that.  If not, then perhaps a couple of us can pool our resources
together to solve this.

Thank you,

-Joe M.

-- 
|   Joe McAlerney     joey () silicondefense com   |
| Silicon Defense - Technical Support for Snort |
|       http://www.silicondefense.com/          |
+--                                           --+

Michael Davis wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> What problems are you seeing with the LibnetNT.dll?
>
> I fixed some problems with LibnetNT so it would work with snort. That
> is why I required people to use MY version of LibnetNT.dll
>
> I can send you my updated LibnetNT Workspace if you want.
>
> Thanks,
> Michael Davis
> Chief Technical Officer
> Data Nerds, LLC.
> http://www.datanerds.net
>
> - ----- Original Message -----
> From: "Frank Knobbe" <FKnobbe () KnobbeITS com>
> To: "'Michael Steele'" <michaels () silicondefense com>;
> <snort-users () lists sourceforge net>; "All Silicon Defense People"
> <all () silicondefense com>
> Sent: Thursday, September 06, 2001 7:06 PM
> Subject: RE: [Snort-users] Snort On Windows - Major Announcement
>
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > > -----Original Message-----
> > > From: Michael Steele [mailto:michaels () silicondefense com]
> > > Sent: Thursday, September 06, 2001 6:34 PM
> > > To: snort-users () lists sourceforge net; All Silicon Defense People
> > > Subject: [Snort-users] Snort On Windows - Major Announcement
> > >
> > > [...]
> > > Notice: FlexResp is BROKENL. We are waiting for a new release of
> > > LibnetNT.dll, and that should fix the problems we are having with
> > > that.
> >
> > How long have we been waiting for patches or an update for LibNetNT
> > now? Do you think it is time to open this project to the community
> > and have more folks than the eEye team working on it? Ryan, if you
> > read this, please let us know what's going.
> >
> >
> > Regards,
> > Frank
> >
> > -----BEGIN PGP SIGNATURE-----
> > Version: PGP Personal Privacy 6.5.8
> > Comment: Free Dmitry Sklyarov !
> >
> > iQA/AwUBO5gPmpytSsEygtEFEQIYqgCg+qAqvfDuvVz56JcOC80BmgcYiSgAoPRS
> > i7AaVDV0HEX1jBemrshG++Ya
> > =9AcZ
> > -----END PGP SIGNATURE-----
> >
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
> -----BEGIN PGP SIGNATURE-----
> Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com>
>
> iQA/AwUBO5jkGfiUqZ9dnoKsEQLqFwCgt8Jn9mFEJKpC4RoQcyYqZI90h10AoON/
> kIEQnNv49JqLaWkHMELg1D1b
> =aewD
> -----END PGP SIGNATURE-----
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users