[Snort-devel] Re: draft rfc - reengineering the snort packet matching system

Fyodor fygrave at ...1...
Mon Apr 9 15:34:40 EDT 2001


On Mon, Apr 09, 2001 at 04:59:00AM -0400, Todd Lewis wrote:
> On Wed, 4 Apr 2001, Todd Lewis wrote:
> 
> > (The Linux kernel file "include/linux/if_ether.h"
> > defines the IP protocol number ("ETH_P_IP") as 0x0800, but I for some
> > reason think that this doesn't actually mean 2048.  Maybe endianness?
> 
> Maybe stupidity.  According to the IANA "ethernet-numbers" document,
> IP actually is ethernet protocol #2048.  If I haven't mentioned it,
> I think that I would make a horrible SANA.  8^)
> 

Actually it sounds correct to me. 2048 is '0x800' hex.. anything wrong with that? :)




More information about the Snort-devel mailing list