[Snort-devel] unknown for src and dst IP's. Latest from CVS

roman at ...49... roman at ...49...
Wed Jun 20 08:48:08 EDT 2001


> On Tue, 19 Jun 2001 roman at ...49... wrote:
> 
> > This logging is the expected behavior.  The use of
> > ip_src0-ip_src3 and ip_dst0-ip_dst3 has been deprecated in
> > favor of a 32-bit unsigned int representation of the IP
> > address (see: ip_src, ip_dst).  If you'll notice in the v103
> > create_mysql script, these fields are no longer present.
> 
> What byte order do you use for these?

Little-Endian; most significant bit at position 31, least significant
at bit 0.

Roman


---------------------------------------------
This message was sent using Voicenet WebMail.
      http://www.voicenet.com/webmail/






More information about the Snort-devel mailing list