Snort mailing list archives
Re: ACID: Bug in decoding of ICMP packets payload?
From: roman () danyliw com
Date: Thu, 10 Jan 2002 22:23:41 EST
Patch committed. thanks, Roman
Thanks for the quick fix; I checked out the CVS source and saw the patch. Didnt new about the padding... Reading the patch I got to: /* Will be incorrect if there are IP options */ $icmp_src_port = hexdec($work[44+$offset].$work[45+$offset].$work[46+$offset].$work[47+$offset]); $icmp_dst_port = hexdec($work[48+$offset].$work[49+$offset].$work[50+$offset].$work[51+$offset]); I think that could easily be fixed with, say: $header=$work[$offset+1]*8+$offset; $icmp_src_port = hexdec($work[$header].$work[$header+1].$work[$header+2].$work[$header+3]); $icmp_dst_port = hexdec($work[$header+4].$work[$header+5].$work[$header+6].$work[$header+7]); Right? Thanks again and good luck, Jesús Couto F. _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
--------------------------------------------- This message was sent using Voicenet WebMail. http://www.voicenet.com/webmail/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- ACID: Bug in decoding of ICMP packets payload? Jesus Couto (Jan 09)
- <Possible follow-ups>
- Re: ACID: Bug in decoding of ICMP packets payload? Roman Danyliw (Jan 09)
- Re: ACID: Bug in decoding of ICMP packets payload? Jesus Couto (Jan 10)
- Re: ACID: Bug in decoding of ICMP packets payload? roman (Jan 10)