[Snort-devel] small patch for snort's PPP decoder
fygrave at ...1...
Sun Jan 21 15:27:17 EST 2001
On Sun, Jan 21, 2001 at 07:05:57PM +0100, Thomas Moestl wrote:
> The reason is simple: DecodePppPkt treats all incoming packets as
> IP packets, but ppp has it's own protocol field and may encapsulate
> different protocols. The way things are currently handled, snort
> might also interpret LCP, IPCP and authorization packets wrongly,
> because those will also be received on raw sockets (at least on
> I have not taken much time to familiarize myself with the snort
> coding style, but I hope the patch is acceptable anway ;-)
> - thomas
> PS: please CC me when answering to the list.
Yup. Thanks, looks good, the piece just has been committed :)
More information about the Snort-devel