Snort mailing list archives

simple mistake in icmp payload calculation


From: "Oliver Friesen" <oliver_friesen () hotmail com>
Date: Sun, 21 Apr 2002 01:41:44 +1000


The header offset that is calculated and then used to pickout the ports from the original datagram is wrong. One of the variables in the calculation is missing the "$". This obviously causes the ports to be incorrect.

here's the diff.
ACID v0.9.6b21

acid_qry_alert.php
559c559
<               $hdr_offset = ($work[$offset+1]) * 8 + offset;
---
              $hdr_offset = ($work[$offset+1]) * 8 + $offset;

Cheers

Oliver Friesen



_________________________________________________________________
Send and receive Hotmail on your mobile device: http://mobile.msn.com


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


Current thread: