Re: (snort_decoder) WARNING: IP dgm len > captured len!

[Russ Combs <rcombs () sourcefire com>]

On Tue, Oct 12, 2010 at 9:07 AM, Martin Roecker <roecker () linogate de> wrote:

> > since were running snort in version 2.9.0 packets with a
> > bigger size than 1369 bytes are droped by snort. This happens
> > when we run snort in inline mode using the ipq daq.
>
> UPDATE: when I start snort with "--snaplen 1518" it is working
> fine. Is it possible that the length calculated is wrong?

The IPQ and NFQ DAQs had an internal buffer limitation that is fixed in the
latest release.

> Martin
>
>
>
> ------------------------------------------------------------------------------
> Beautiful is writing same markup. Internet Explorer 9 supports
> standards for HTML5, CSS3, SVG 1.1,  ECMAScript5, and DOM L2 & L3.
> Spend less time writing and  rewriting code and more time creating great
> experiences on the web. Be a part of the beta today.
> http://p.sf.net/sfu/beautyoftheweb
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------------------------------
Achieve Improved Network Security with IP and DNS Reputation.
Defend against bad network traffic, including botnets, malware, 
phishing sites, and compromised hosts - saving your company time, 
money, and embarrassment.   Learn More! 
http://p.sf.net/sfu/hpdev2dev-nov

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users