Re: [Snort-devel] 'established' with Snort 2.x on openbsd

From: Jon Hart <warchild(at)spoofed.org>
Date: Fri Apr 02 2004 - 08:57:51 EST

On Fri, Apr 02, 2004 at 09:56:04AM +0200, Andreas ?stling wrote:
>
> The answer from Chris in that thread indicated that this is often because of

I saw that in Chris's post too, but when I went to verify the checksusms nothing seemed wrong. I guess I didn't look hard enough because all the packets to spoofed.org have correct checksums and all the packets from spoofed.org incorrect checksums.

So now I'm gonna track down the source of the bad checksums. I'm fairly certain the hardware isn't failing because I tried the same thing on a different card (albeit the same driver, xl(4)) and had the same problems. Actually it looks like my card, a 3Com 3C905B has hardware checksumming and the xl driver will use it if available, but according to the openbsd archives this is known to cause problems yet it remains on. FreeBSD has disabled it for this very reason.

So, I'm either going to hack xl(4) to disable the checksums or just swap to other cards in the system.

Thanks!

-jon

---

This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click

---

Snort-devel mailing list
Snort-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-devel Received on Fri Apr 2 09:09:30 2004