Re: [Snort-devel] 'established' with Snort 2.x on openbsd

From: Jon Hart <warchild(at)spoofed.org>
Date: Fri Apr 02 2004 - 10:34:22 EST

On Fri, Apr 02, 2004 at 09:58:29AM -0500, Chris Green wrote:
> You can also turn off checksumming for snort. Even nicer would be to

Certainly a good idea, but since both my internal and external interfaces are xl(4) based, I want to know when something is *really* wrong and bad checksums start flying. I just used a patch similar to:

https://citadelle.intrinsec.com/mailing/current/HTML/ml_openbsd-bugs/2992.html

and hardware checksumming is now off, and my checksums are now correct and snort is once again working.

> If you are only doing read back analysis, netdude (netdude.sf.net)

Yeah, netdude++. Its high up on my list of "tools that don't suck" and I use it quite often.

Thanks again,

-jon

---

This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click

---

Snort-devel mailing list
Snort-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-devel Received on Fri Apr 2 10:56:40 2004