Snort mailing list archives
Re: ACID: Bug in decoding of ICMP packets payload?
From: Jesus Couto <jesus.couto () satec es>
Date: Thu, 10 Jan 2002 19:21:22 +0100
Thanks for the quick fix; I checked out the CVS source and saw the patch. Didnt new about the padding...
Reading the patch I got to: /* Will be incorrect if there are IP options */$icmp_src_port = hexdec($work[44+$offset].$work[45+$offset].$work[46+$offset].$work[47+$offset]); $icmp_dst_port = hexdec($work[48+$offset].$work[49+$offset].$work[50+$offset].$work[51+$offset]);
I think that could easily be fixed with, say: $header=$work[$offset+1]*8+$offset;$icmp_src_port = hexdec($work[$header].$work[$header+1].$work[$header+2].$work[$header+3]); $icmp_dst_port = hexdec($work[$header+4].$work[$header+5].$work[$header+6].$work[$header+7]);
Right? Thanks again and good luck, Jesús Couto F. _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- ACID: Bug in decoding of ICMP packets payload? Jesus Couto (Jan 09)
- <Possible follow-ups>
- Re: ACID: Bug in decoding of ICMP packets payload? Roman Danyliw (Jan 09)
- Re: ACID: Bug in decoding of ICMP packets payload? Jesus Couto (Jan 10)
- Re: ACID: Bug in decoding of ICMP packets payload? roman (Jan 10)