logo       

Embeded ICMP packet is partially printed.: msg#00010

security.ids.snort.devel

Subject: Embeded ICMP packet is partially printed.

Hi again,

This another issue with encapsulated packets inside
ICMP data. If the encapsulated packet is also ICMP,
the PrintICMPHeader() function in log.c prints only
the IP header of the encapsulated packet and not the
ICMP header and data of the packet.

I think this is a bug because in PrintICMPHeader
function a new Packet is constructed and the all the
original headers are copied to the new packet, except
the icmp header.
The line
orig->icmph = p->orig_icmph;
is missing from the code taken from log.c below.

-----------------------------------
Packet op;
Packet *orig_p;
int orig_iph_size;

bzero((char *) &op, sizeof(Packet));
orig_p = &op;
orig_p->iph = p->orig_iph;
orig_p->tcph = p->orig_tcph;
orig_p->udph = p->orig_udph;
orig_p->sp = p->orig_sp;
orig_p->dp = p->orig_dp;
---------------------------------

John.

__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com

-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642


<Prev in Thread] Current Thread [Next in Thread>
Google Custom Search

News | FAQ | advertise