[Snort-devel] Re: draft rfc - reengineering the snort packet matching system

Todd Lewis tlewis at ...255...
Mon Apr 9 15:36:06 EDT 2001


The stupidity part was not in the conversion, but in thinking that 2048
was wrong.

--
Todd Lewis
tlewis at ...255...

On Tue, 10 Apr 2001, Fyodor wrote:

> On Mon, Apr 09, 2001 at 04:59:00AM -0400, Todd Lewis wrote:
> > On Wed, 4 Apr 2001, Todd Lewis wrote:
> > 
> > > (The Linux kernel file "include/linux/if_ether.h"
> > > defines the IP protocol number ("ETH_P_IP") as 0x0800, but I for some
> > > reason think that this doesn't actually mean 2048.  Maybe endianness?
> > 
> > Maybe stupidity.  According to the IANA "ethernet-numbers" document,
> > IP actually is ethernet protocol #2048.  If I haven't mentioned it,
> > I think that I would make a horrible SANA.  8^)
> > 
> 
> Actually it sounds correct to me. 2048 is '0x800' hex.. anything wrong with that? :)
> 





More information about the Snort-devel mailing list