Re: maximum length for msg?

[Alex Kirk <alex.kirk () sourcefire com>]

Dirk Geschke wrote:

> Hi Alex,
>
>  
>
> > You are correct about that line being present in decode.h. However, that 
> > #define doesn't seem to have any effect on Snort's ability to deal with 
> > longer msg strings. For example, I tested 2.3.3 and 2.4 with a fake rule 
> > designed to maximize the length of that string:
> >    
>
> yes, but you did not check all output-plugins:
>  
Which is why I generally recommended not using longer msg strings, why I 
was so cautious to note that I had not read all of the relevant code, 
and why I stated that I might be missing something that would break as a 
result of this.

> output-plugins/spo_alert_unixsock.c, line 197:              
>
> strlen(msg)>ALERTMSG_LENGTH-1 ? ALERTMSG_LENGTH - 1 : strlen(msg));
>
> Ok, I think no one really wants to use a message larger than 255 
> bytes...
>  
Which is probably true from a usability perspective anyway -- if you've 
got a msg string bigger than that, it's going to be a lot to read, and 
it's probably going to be so specific/detailed/whatever that it won't 
make sense to anyone except the person who wrote it.

Alex Kirk
Research Analyst
Sourcefire, Inc.


-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server. Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP.  Click here to play: http://sourceforge.net/geronimo.php
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users