Fwd: Re: [Snort-devel] Race Conditions

Peter Moore peter at ...799...
Thu May 9 05:31:02 EDT 2002

What database are you using? i am testing my Sybase plugin that i wrote for 
Snort and due to a bug i had, it complained about not being able to insert 
due to a duplicate key (ie the record was already there) but it didn't put 
Snort into a race condition....Snort merely reported the error and kept 
running as per normal.
ps i shall try and release the Sybase code by the end of May once i am 
satisfied it is working ok.
Peter Moore

peter at ...799...
ICQ 926967 (old) 95022055 (new - Oct 18, 2000)
>One a network we have several intrusion detection systems running. How do
>you get round the problem of two snort systems detecting the same event at
>the same time and reporting it to the data base. If the signature had not
>been seen before that both sensors would attempt to insert the signature for
>the first time. One would succedd and one would have. On the console of the
>system that failed an error message would be created. So how do you stop
>this race conditon?
>Have big pipes? SourceForge.net is looking for download mirrors. We supply
>the hardware. You get the recognition. Email Us: bandwidth at ...12...
>Snort-devel mailing list
>Snort-devel at lists.sourceforge.net

More information about the Snort-devel mailing list