[Snort-devel] SpoAlertUnixSock

Fyodor fygrave at ...1...
Thu Sep 6 11:26:08 EDT 2001


 
> It is also a good idea to add the event struct before the packet. The 
> packte contains a full ehternet packet of size 1514 byes. This is not
> on a 4 byte boundary so some compilers add two additional bytes at the
> end of the structure. Simply appending the event to the alertpkt results
> in a misfit of two bytes...
> 

Hmmm.. all right. let me recalculate where it fits :p

-- 
http://www.notlsd.net
PGP fingerprint = 56DD 1511 DDDA 56D7 99C7  B288 5CE5 A713 0969 A4D1




More information about the Snort-devel mailing list