[Snort-devel] 1.9.0, signature ID 1

Chris Green cmg at ...835...
Mon Nov 25 07:37:03 EST 2002

"Steven P. Donegan" <donegan at ...1695...> writes:

> I have observed a bogus signature ID 1 event, from my spo_ plugin - this
> occurs during a nessus scan. The event and p structures are non-null during
> the plugin callback. 

what does p->packet_flags show?

> The data in those structures appears to be from earlier callbacks -
> i.e. some of it appears valid, some not. Has anyone seen anything
> like this? At present I'm just dropping any ID == 1, but would
> prefer to find the root cause :-)

Chris Green <cmg at ...402...>
This is my signature. There are many like it but this one is mine.

More information about the Snort-devel mailing list