[Snort-devel] Apparent bug with 'NEXT LINK MTU' output

James Hoagland hoagland at ...60...
Fri May 10 10:13:04 EDT 2002


Hello all,

I just stumbled across a mini-bug in PrintICMPHeader().  There is a 
newline at the end of the output in the ICMP_FRAG_NEEDED case:

                 case ICMP_FRAG_NEEDED:
                     fprintf(fp, "FRAGMENTATION NEEDED, DF SET\n"
                             "NEXT LINK MTU: %u\n",
                             ntohs(p->icmph->s_icmp_nextmtu));
                     break;

In all the parallel cases (including ICMP_PKT_FILTERED, the other 
multi-line case), there is not newline at the end.  So this would 
seem to be a little typo.  The effect of this is that an alert is not 
all in one paragraph, but instead there is an empty line in the 
middle.

Attached is a small patch against 1.8.7beta2.  (Or just fire up vi 
and hit 'x' twice. :) )

Kind regards,

   Jim
-- 
|*      Jim Hoagland, Associate Researcher, Silicon Defense      *|
|*            --- Silicon Defense: IDS Solutions ---             *|
|*  hoagland at ...60..., http://www.silicondefense.com/  *|
|*   Voice: (530) 756-7317                 Fax: (530) 756-7297   *|
-------------- next part --------------
A non-text attachment was scrubbed...
Name: log.c.patch
Type: application/mac-binhex40
Size: 642 bytes
Desc: not available
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20020510/8fb58848/attachment.hqx>


More information about the Snort-devel mailing list