|
Embeded ICMP packet is partially printed.: msg#00010security.ids.snort.devel
Hi again, This another issue with encapsulated packets inside ICMP data. If the encapsulated packet is also ICMP, the PrintICMPHeader() function in log.c prints only the IP header of the encapsulated packet and not the ICMP header and data of the packet. I think this is a bug because in PrintICMPHeader function a new Packet is constructed and the all the original headers are copied to the new packet, except the icmp header. The line orig->icmph = p->orig_icmph; is missing from the code taken from log.c below. ----------------------------------- Packet op; Packet *orig_p; int orig_iph_size; bzero((char *) &op, sizeof(Packet)); orig_p = &op; orig_p->iph = p->orig_iph; orig_p->tcph = p->orig_tcph; orig_p->udph = p->orig_udph; orig_p->sp = p->orig_sp; orig_p->dp = p->orig_dp; --------------------------------- John. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com ------------------------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 |
|
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| Previous by Date: | Missing ICMP decodes?: 00010, John Papapanos |
|---|---|
| Next by Date: | 2.6.0 mem bug or me?: 00010, Earl |
| Previous by Thread: | Missing ICMP decodes?i: 00010, John Papapanos |
| Next by Thread: | 2.6.0 mem bug or me?: 00010, Earl |
| Indexes: | [Date] [Thread] [Top] [All Lists] |
| News | FAQ | advertise |