[Snort-devel] 1.9.0, signature ID 1

Steven P. Donegan donegan at ...1695...
Mon Nov 25 07:20:02 EST 2002


I have observed a bogus signature ID 1 event, from my spo_ plugin - this
occurs during a nessus scan. The event and p structures are non-null during
the plugin callback. The data in those structures appears to be from earlier
callbacks - i.e. some of it appears valid, some not. Has anyone seen
anything like this? At present I'm just dropping any ID == 1, but would
prefer to find the root cause :-)





More information about the Snort-devel mailing list