[Snort-devel] ACK. Re: [Snort-users] version.bind (part of the problem) (fwd)

Fyodor fygrave at ...1...
Fri Feb 9 10:06:29 EST 2001

On Thu, Feb 08, 2001 at 03:52:41PM -0800, Max Vision wrote:
> Ok I am stumped.  The depth:18; tag shouldn't even work!  The version.bind
> string goes about 25 bytes into the packet...
> Something is definately broken.  Additionally, I may be confused about the
> nature of depth (I thought depth 18 would only consiuder bytes 0-18), but
> even if I'm confused, something is still broken as depth:26; isn't working
> for some people.
> help?

there seems to be something wrong here.. people report that depth: 32 doesn't work
for them while depth: 18, but depth: 32 actually includes depth: 18.. smells very fishy... lemme play with that too :)

More information about the Snort-devel mailing list