Re: snort 1.9.1 message (decoded length message from rpc_decode)

[Matt Kettler <mkettler () evi-inc com>]

Hope you don't mind I changed the subject to something more specific, might 
draw attention from someone more educated on the RPC decoder who's just 
skimming subject lines.

This message appears to be generated by the RPC decode preprocessor, and 
seems to be the result of some sanity checking on the RPC packets. This 
would appear to mean that the RPC decoder thinks a message is trying to 
evade detection by sending fragments in a strange order, but would appear 
to be possible any time a RPC packet is fragmented and arrives out-of-order.

Someone more familiar with spp_rpc_decode.c might be able to comment in a 
more educated fashion, but at least I can tell you where it came from.



At 05:55 AM 3/19/2003 +0000, you wrote:

> hi
>
> When I start my second sensor, which alerts in the
> remote mysql server, I get this message.
>
> calllogfuncs() decoded length does not compute!
>
> I keep on getting this message very often.
>
> I don't know it is an error, warning or what.
>
> Cna anybody enlighten me on this message and how to
> avoid it ?
>
> Thanx.
>
> Bishan
>
> =====
> Celebrating Happiness
> email: bishan () sumerusolutions com
> company: www.sumerusolutions.com
>
> __________________________________________________
> Do You Yahoo!?
> Everything you'll ever need on one web page
> from News and Sport to Email and Music Charts
> http://uk.my.yahoo.com
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: Does your code think in ink?
> You could win a Tablet PC. Get a free Tablet PC hat just for playing.
> What are you waiting for?
> http://ads.sourceforge.net/cgi-bin/redirect.pl?micr5043en
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users



-------------------------------------------------------
This SF.net email is sponsored by: Does your code think in ink? 
You could win a Tablet PC. Get a free Tablet PC hat just for playing. 
What are you waiting for?
http://ads.sourceforge.net/cgi-bin/redirect.pl?micr5043en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users