Snort mailing list archives
RE: (snort_decoder): Short UDP packet, length field > payload leng
From: "M. Shirk" <shirkdog_list () hotmail com>
Date: Thu, 14 Jul 2005 11:53:54 -0400
Does the vendor know the network impact of their product? (or any specs on the protocols the product uses for you to research?)
Shirkdog http://www.shirkdog.us
From: "Willy, Andrew" <AWilly () eSMIL net> To: snort-users () lists sourceforge netSubject: RE: [Snort-users] (snort_decoder): Short UDP packet, length field > payload lengthDate: Thu, 14 Jul 2005 08:42:38 -0700 Interesting, I just saw this alert for the first time yesterday. When you say it is a bad thing, you mean as in potential exploit? The were four alerts that originated from a vendor machine that plugged into our DMZ. As far as I can tell, there is no payload. I'm not sure what to make of it. Thank you, Andrew -----Original Message----- From: Jason Brvenik [mailto:jason.brvenik () sourcefire com] Sent: Thursday, July 07, 2005 11:43 AM To: Flora.francesco Cc: snort-users () lists sourceforge net Subject: Re: [Snort-users] (snort_decoder): Short UDP packet, length field > payload length It means that the system saw a UDP packet which indicated it's length was greater than the actual payload. This should not happen and is generally a bad thing. Flora.francesco wrote: > what kind of alert is that? > thanks a lot NOTICE OF CONFIDENTIALITY-The information in this email, including attachments, may be confidential and/or privileged and may contain confidential health information. This email is intended to be reviewed only by the individual or organization named as addressee. If you have received this email in error please notify Scottsdale Medical Imaging, an affiliate of Southwest Diagnostic Imaging, LTD immediately - by return message to the sender or to support () esmil com - and destroy all copies of this message and any attachments. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of Scottsdale Medical Imaging. Confidential health information is protected by state and federal law, including, but not limited to, the Health Insurance Portability and Accountability Act of 1996 and related regulations. ------------------------------------------------------- SF.Net email is sponsored by: Discover Easy Linux Migration Strategies from IBM. Find simple to follow Roadmaps, straightforward articles, informative Webcasts and more! Get everything you need to get up to speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
_________________________________________________________________Dont just search. Find. Check out the new MSN Search! http://search.msn.click-url.com/go/onm00200636ave/direct/01/
------------------------------------------------------- SF.Net email is sponsored by: Discover Easy Linux Migration Strategies from IBM. Find simple to follow Roadmaps, straightforward articles, informative Webcasts and more! Get everything you need to get up to speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- RE: (snort_decoder): Short UDP packet, length field > payload length Willy, Andrew (Jul 14)
- RE: (snort_decoder): Short UDP packet, length field > payload leng M. Shirk (Jul 14)