Snort mailing list archives
the max limit in BPF filter
From: "Joseph Chen" <cax0cn () gmail com>
Date: Sat, 16 Jun 2007 11:49:28 +0800
Hi,list; My test environment is snort-2.6.1.4, oracle 9.0, RH9.0 and RHEL AS4; when I try to setup a bpf filter file which has 243 bytes, I got an error: Jun 16 11:29:50 admin snort[2485]: database: oracle_error: ORA-01401: inserted value too large for column Jun 16 11:29:50 admin snort[2485]: : query: INSERT INTO sensor (hostname, interface, filter, detail, encoding, last_cid) VALUES (' 124.124.1.24','eth0','not (dst net 122.122.122) and not (dst net 121.121.121) and not (dst net 20.20.20) and not (dst net 22.22.22) and not (dst net 222.222.222) and not (dst host 111.11.1.1) and not (dst host 111.111.111.111) ',1,0, 0) Jun 16 11:29:50 admin snort[2485]: database: Problem obtaining SENSOR ID (sid) from depsight->sensor after cheching the source code of snort-2.6.1.4, I found that the limitation is from the SQL script, which is different from database type: CREATE TABLE sensor ( sid SERIAL, hostname TEXT, interface TEXT, filter TEXT, NOTE THAT: the column of filter is TEXT here, while in MsSQL and Oracle it's varchar(100), this caused the listed error. my question is can I modify this setting to avoid the previous errors? does it have any disadvantage to snort? thanks, joseph
------------------------------------------------------------------------- This SF.net email is sponsored by DB2 Express Download DB2 Express C - the FREE version of DB2 express and take control of your XML. No limits. Just data. Click to get it now. http://sourceforge.net/powerbar/db2/
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- the max limit in BPF filter Joseph Chen (Jun 15)