Snort mailing list archives
SnortDB Extra
From: "Joshua Berry" <jberry () PENSON COM>
Date: Tue, 8 Jun 2004 13:49:20 -0500
Maybe I am using it wrong, but the flags table from SnortDB Extra seems to be off in many places. For instance, when I lookup a SYN/FIN alert the tcp_flags number in tcphdr associated with the alert is 3. But looking up 3 in the flags table produces this description: NULL Packet (reserved bit 1 & 2 active) Is this wrong or am I interpreting the value of the fields wrong? Josh Berry, CISSP & MCSE Information Security 214-765-1296 -------------------------------------------------------------------- If you spend more on coffee than on IT security, you will be hacked. What's more, you deserve to be hacked. -- (Former) White House Cybersecurity adviser Richard Clarke ------------------------------------------------------- This SF.Net email is sponsored by: GNOME Foundation Hackers Unite! GUADEC: The world's #1 Open Source Desktop Event. GNOME Users and Developers European Conference, 28-30th June in Norway http://2004/guadec.org _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- SnortDB Extra Joshua Berry (Jun 08)
- <Possible follow-ups>
- Re: SnortDB Extra Gary_Portnoy (Jun 09)
- RE: SnortDB Extra Joshua Berry (Jun 09)