Snort mailing list archives
Re: Snort dont understand pf (openbsd) format
From: kiko () async com br (Christian Robottom Reis)
Date: Tue, 30 Nov 2004 16:18:21 -0200
On Tue, Nov 30, 2004 at 11:44:03AM -0500, Matt Kettler wrote:
I'm not sure which version of OpenBSD changed the format, but there is a new and an old format in OpenBSD 3.5's if_pflog.h. Snort's handling code matches the old format.Did a bit of digging. snort's pflog format matches the one used by OpenBSD 3.3, but not 3.4 or newer http://www.openbsd.org/cgi-bin/cvsweb/src/sys/net/if_pflog.h
Thanks Matt. I was almost sure there was a real issue there; we had testing on OpenBSD before and I had seen the results.
rev 1.7 was used in 3.3 and only has one pflog header format. Rev 1.8 introduced the change. It appears that the old format goes with bpf.h's datalink type DLT_OLD_PFLG (17), but the new one goes with DLT_PFLOG (117). Unfortunately, in OpenBSD 3.3 the old format is DLT_PFLOG (17). Probably need to do some weird ifdefs to properly patch snort to deal with both old and new systems. If DLT_OLD_PFLG isn't defined, it's the only pflog format, if it is, you can support both old and new.
Okay, so either we get some diffs moving or we get the clients to downgrade OpenBSD. Fun, fun. Let's see if I can convince Breno to hack some snort code, and maybe we will have some patches against head to get us going. It is certainly an unexpected error, and I thought more people would have run into it, but maybe not. Take care, -- Christian Robottom Reis | http://async.com.br/~kiko/ | [+55 16] 3361 2331 ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://productguide.itmanagersjournal.com/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort dont understand pf (openbsd) format Breno Leitão (Nov 29)
- Re: Snort dont understand pf (openbsd) format Matt Kettler (Nov 29)
- Re: Snort dont understand pf (openbsd) format Matt Kettler (Nov 29)
- Re: Snort dont understand pf (openbsd) format Sean Brown (Nov 29)
- Re: Snort dont understand pf (openbsd) format Matt Kettler (Nov 29)
- Re: Snort dont understand pf (openbsd) format Sean Brown (Nov 29)
- Re: Snort dont understand pf (openbsd) format Matt Kettler (Nov 30)
- Re: Snort dont understand pf (openbsd) format Matt Kettler (Nov 30)
- Re: Snort dont understand pf (openbsd) format Christian Robottom Reis (Nov 30)
- Re: Snort dont understand pf (openbsd) format Sean Brown (Nov 30)
- Re: Snort dont understand pf (openbsd) format Christian Robottom Reis (Dec 01)
- Re: Snort dont understand pf (openbsd) format Jeremy Hewlett (Dec 01)
- Re: Snort dont understand pf (openbsd) format Breno Leitão (Dec 02)
- snort patch to understand pflog (ond and new) Breno Leitão (Dec 03)
- Re: Snort dont understand pf (openbsd) format Matt Kettler (Nov 29)
- Re: Snort dont understand pf (openbsd) format Matt Kettler (Nov 29)
- Re: Snort dont understand pf (openbsd) format M. Shirk (Dec 01)
- Re: Snort dont understand pf (openbsd) format Christian Robottom Reis (Dec 01)