[Snort-devel] possible bug in DecodeVlan

Martin Roesch roesch at ...402...
Mon Jan 28 19:37:05 EST 2002


Hi Nick,
     I've you've got some pcap packet captures, I'd like to check it out.

    -Marty

On 1/28/02 11:46 AM, "Nick Petroni" <npetroni at ...1103...> wrote:

> Just a quick question on some code I noticed in decode.c.
> lines 171 and 178, should the second argument to the function calls be as
> follows?
> 
> len - sizeof(VlanTagHdr) - sizeof(EthLlc) -  sizeof(EthLlcOther)
> 
> seems like the length isn't being decremented enough. Don't think this
> would cause any harm based on the calls being made.
> 
> Nick L. Petroni, Jr.
> Graduate Student, Computer Science
> University of Maryland
> http://www.cs.umd.edu/~npetroni
> 
> 
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-devel
> 

-- 
Martin Roesch - Founder/CEO Sourcefire Inc. - (410) 552-6999
Sourcefire: Professional Snort Sensor and Management Console appliances
roesch at ...402... - http://www.sourcefire.com
Snort: Open Source Network IDS - http://www.snort.org





More information about the Snort-devel mailing list