Snort mailing list archives

Re: simple mistake in icmp payload calculation


From: "Roman Danyliw" <roman () danyliw com>
Date: Sat, 20 Apr 2002 12:01:18 -0400 (EDT)

This was fixed in CVS weeks ago.

thanks,
Roman

On Sun, 21 Apr 2002 01:41:44 +1000, "Oliver Friesen"
<oliver_friesen () hotmail com> wrote :


The header offset that is calculated and then used to pickout the ports from 
the original datagram is wrong. One of the variables in the calculation is 
missing the "$". This obviously causes the ports to be incorrect.

here's the diff.
ACID v0.9.6b21

acid_qry_alert.php
559c559
<               $hdr_offset = ($work[$offset+1]) * 8 + offset;
---
              $hdr_offset = ($work[$offset+1]) * 8 + $offset;

Cheers

Oliver Friesen



_________________________________________________________________
Send and receive Hotmail on your mobile device: http://mobile.msn.com





_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


Current thread: