[Snort-devel] 1.9.0, signature ID 1
cmg at ...835...
Mon Nov 25 07:37:03 EST 2002
"Steven P. Donegan" <donegan at ...1695...> writes:
> I have observed a bogus signature ID 1 event, from my spo_ plugin - this
> occurs during a nessus scan. The event and p structures are non-null during
> the plugin callback.
what does p->packet_flags show?
> The data in those structures appears to be from earlier callbacks -
> i.e. some of it appears valid, some not. Has anyone seen anything
> like this? At present I'm just dropping any ID == 1, but would
> prefer to find the root cause :-)
Chris Green <cmg at ...402...>
This is my signature. There are many like it but this one is mine.
More information about the Snort-devel