Re: Snort 1.8.7 (Unaligned access)

[Matt Kettler <mkettler () evi-inc com>]

I'm not super-educated on the subject, but here's what little I know about 
the subject. Perhaps someone else has a better idea than I...


In general an Unaligned access like that means that a structure member was 
accessed at a memory alignment that was not an even multiple of it's size. 
Most 32 bit processors are tolerant of this, most 64bit ones are not and it 
causes a processor exception.

For example, if I had a structure consisting of:

4byte field   n1
1 byte field  b1
4byte field   n2

and the whole structure was forced to be single-byte aligned, accessing n2 
causes an exception on any processor with strict alignment rules (ie: some 
64bit ones and a few 32bit risc ones), but is perfectly fine on most 
byte-oriented 32bit processors.

Most of the time structures are declared without specific alignment so if 
needed the compiler inserts padding bytes so that all members are accessed 
in proper alignment.

Why snort would have such an alignment issue isn't clear to me. TCP/IP 
headers are all aligned pretty well, and those are likely to be the only 
packed structs needed in snort.


At 02:51 PM 7/11/2002 -0400, Darryl Cook wrote:
> I have installed snort 1.8.7 on a Tru64 5.1 box and get the following
> when I run snort...
> Unaligned access pid=55588 <snort> va=etc etc inst=etc etc
>
> I get lots of these .... snort seems to run ok though.
>
> Any ideas of what may be causing this?
>
> thanks,
> darryl
>
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> PC Mods, Computing goodies, cases & more
> http://thinkgeek.com/sf
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
PC Mods, Computing goodies, cases & more
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users