Snort mailing list archives
Re: Snort bug with stream reassembly??
From: <scheidell () secnap net>
Date: Mon, 25 Aug 2003 17:15:29 -0400
<snort () auscert org au> wrote in message news:<200308200700.h7K70p4D067533 () app auscert org au>...
Hi, I appear to have discovered what I think might be a snort/preprocessor bug related to stream reassembly. In brief, the packet payloads get associated with the wrong packet headers from what I can tell :( I am using snort 2.0.1 (build 88) on FreeBSD-4.8.
has been happening to me since snort 2.00. Others have reported source and dst ports being 'swapped'. Might have to do with a stream reassembly bug. Might want to turn off stream reassembly and see which one is doing it. ps, I am also using FBSD 4.8. ------------------------------------------------------- This SF.net email is sponsored by: VM Ware With VMware you can run multiple operating systems on a single machine. WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the same time. Free trial click here:http://www.vmware.com/wl/offer/358/0 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort bug with stream reassembly?? snort (Aug 20)
- <Possible follow-ups>
- Re: Snort bug with stream reassembly?? scheidell (Aug 25)