Snort mailing list archives
Re: Barnyard and ACID question
From: "Andrew R. Baker" <andrewb () snort org>
Date: Tue, 06 Nov 2001 22:14:34 -0800
Steve Halligan wrote:
I am having this problem also. OpenBSD 2.9-release here. Barnyard from CVS today. snort-unified-logfile is attached. I also noticed that sometimes (although not in this logfile, I believe) the ordering of the source ip address backwards also a.b.c.d becomes d.c.b.a. The dest ip is unaffected.
I have fixed the problem with byteswapped port numbers in the db output plugin. The new code is in CVS. It was a case where I was converting a number that had already been converted. As for reversed IP addresses, I would be interested in seeing the log file where this happens. I checked all of the places where the src IP is inserted and they all look okay. -A _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Barnyard and ACID question Wozz (Nov 05)
- Re: Barnyard and ACID question roel (Nov 05)
- Re: Barnyard and ACID question Wozz (Nov 05)
- Re: Barnyard and ACID question Andrew R. Baker (Nov 06)
- <Possible follow-ups>
- RE: Barnyard and ACID question Steve Halligan (Nov 06)
- Re: Barnyard and ACID question Andrew R. Baker (Nov 06)
- RE: Barnyard and ACID question Steve Halligan (Nov 06)
- Re: Barnyard and ACID question Andrew R. Baker (Nov 06)
- Re: Barnyard and ACID question Wozz (Nov 07)
- Re: Barnyard and ACID question Wozz (Nov 07)
- Re: Barnyard and ACID question Andrew R. Baker (Nov 06)
- RE: Barnyard and ACID question Steve Halligan (Nov 06)
- Re: Barnyard and ACID question Andrew R. Baker (Nov 06)
- Re: Barnyard and ACID question roel (Nov 05)