Re: session reassembly on windows

[Martin Roesch <roesch () sourcefire com>]

This was fixed in CVS last night.

    -Marty

Joe McAlerney wrote:
> Ack!  Well we fixed that, but it looks like it didn't make it into the
> CVS tree yet.  I'll throw up a patched version.
>
> Regards,
>
> -Joe M.
>
> --
> |   Joe McAlerney     joey () silicondefense com   |
> | Silicon Defense - Technical Support for Snort |
> |       http://www.silicondefense.com/          |
> +--                                           --+
>
> Frank Knobbe wrote:
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > > -----Original Message-----
> > > From: chris_chris () hushmail com [mailto:chris_chris () hushmail com]
> > > Sent: Friday, August 10, 2001 5:44 AM
> > >
> > > The BETA BETA BETA release of Snort 1.8.1 Beta 6 for the
> > > Windows platform, but it gives an error when I add a session
> > > reassembly rule.
> > >
> > > " ERROR: OpenLogFile() =>
> > > fopen(d:\ids_center\snortlogs/192.168.0.7/TCP:1726-80.ids)
> > > log file : Invalid argument..
> > > [...]
> > >   I am working on windows 2000 professional.
> >
> > My guess is that it is related to the issue I encountered yesterday.
> > The problem is that the file name is invalid. A ':' within the
> > filename denotes an Alternate Data Streams on Windows platforms. I
> > submitted a fix for that yesterday (where a '_' is used instead of a
> > ':'), but I'm not sure if it has been committed to CVS yet.
> >
> > Regards,
> > Frank
> >
> > -----BEGIN PGP SIGNATURE-----
> > Version: PGP Personal Privacy 6.5.8
> > Comment: PGP or S/MIME encrypted email preferred.
> >
> > iQA/AwUBO3PycpytSsEygtEFEQKNTQCgmC6mAUJ3/f7juckBlqYEYQlq7eIAnio1
> > NBCiLPTvRilX7MMQ+4lqvnGs
> > =+Szf
> > -----END PGP SIGNATURE-----
> >
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > http://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

--
Martin Roesch
roesch () sourcefire com
http://www.sourcefire.com - http://www.snort.org

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users