RE: [Snort-devel] Header mixup Bug in Snort 2.0?

From: Erik Norman <carl_erik.norman(at)telia.com>
Date: Mon Jun 16 2003 - 15:29:34 EDT

Hi all,

This issue has been confirmed as a bug with Snort2.0, but *not* with Snort current (b087). So unless anyone wants to dig deeper, I leave it at that. Thanks to rmkml@wanadoo.fr for help, input, and commitment to Snort.

For the curious:

I isolated a tcpdump file containing two tcp sessions. When testing the two sessions separately, no alarm was triggered. When testing the two in the same file, several alarms of the same type (uid=...) were triggered. Not good :-)

The bug was verified to exist on two different plattforms (Linux 2.2.16 & NetBSD 1.6.1). Regrettely, I can not send/publish the raw data.

Thank you for Snort, guys.

/E

> -----Original Message-----

---

This SF.NET email is sponsored by: eBay
Great deals on office technology -- on eBay now! Click here: http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5

---

Snort-devel mailing list
Snort-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-devel Received on Mon Jun 16 15:45:32 2003