Snort mailing list archives
Re: Snort 1.8.7 (Unaligned access)
From: Matt Kettler <mkettler () evi-inc com>
Date: Thu, 11 Jul 2002 16:35:19 -0400
I'm not super-educated on the subject, but here's what little I know about the subject. Perhaps someone else has a better idea than I...
In general an Unaligned access like that means that a structure member was accessed at a memory alignment that was not an even multiple of it's size. Most 32 bit processors are tolerant of this, most 64bit ones are not and it causes a processor exception.
For example, if I had a structure consisting of: 4byte field n1 1 byte field b1 4byte field n2and the whole structure was forced to be single-byte aligned, accessing n2 causes an exception on any processor with strict alignment rules (ie: some 64bit ones and a few 32bit risc ones), but is perfectly fine on most byte-oriented 32bit processors.
Most of the time structures are declared without specific alignment so if needed the compiler inserts padding bytes so that all members are accessed in proper alignment.
Why snort would have such an alignment issue isn't clear to me. TCP/IP headers are all aligned pretty well, and those are likely to be the only packed structs needed in snort.
At 02:51 PM 7/11/2002 -0400, Darryl Cook wrote:
I have installed snort 1.8.7 on a Tru64 5.1 box and get the following when I run snort... Unaligned access pid=55588 <snort> va=etc etc inst=etc etc I get lots of these .... snort seems to run ok though. Any ideas of what may be causing this? thanks, darryl ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek PC Mods, Computing goodies, cases & more http://thinkgeek.com/sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek PC Mods, Computing goodies, cases & more http://thinkgeek.com/sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort 1.8.7 Chris Green (Jul 08)
- Re: Snort 1.8.7 Florin Andrei (Jul 09)
- Re: Snort 1.8.7 Chris Green (Jul 09)
- <Possible follow-ups>
- Snort 1.8.7 Darryl Cook (Jul 11)
- Re: Snort 1.8.7 Chris Green (Jul 11)
- Re: Snort 1.8.7 (Unaligned access) Matt Kettler (Jul 11)
- RE: Snort 1.8.7 Jason Gauthier (Jul 11)
- Re: Snort 1.8.7 Florin Andrei (Jul 09)