[Snort-devel] small patch for snort's PPP decoder

Fyodor fygrave at ...1...
Sun Jan 21 15:27:17 EST 2001


On Sun, Jan 21, 2001 at 07:05:57PM +0100, Thomas Moestl wrote:

> 
> The reason is simple: DecodePppPkt treats all incoming packets as
> IP packets, but ppp has it's own protocol field and may encapsulate
> different protocols. The way things are currently handled, snort
> might also interpret LCP, IPCP and authorization packets wrongly,
> because those will also be received on raw sockets (at least on

> 
> I have not taken much time to familiarize myself with the snort
> coding style, but I hope the patch is acceptable anway ;-)
> 
> 	- thomas
> 
> PS: please CC me when answering to the list.
> 


Yup. Thanks, looks good, the piece just has been committed :)




More information about the Snort-devel mailing list