[Snort-devel] new pb on snort v2 ? (icmp large packet)

Chris Green cmg at ...402...
Wed Apr 23 08:03:33 EDT 2003

Chris Green <cmg at ...402...> writes:

> rmkml <rmkml at ...1042...> writes:
>> Hi,
> I get large ping requests if I comment out the icmp-info.rules, echo
> request/reply otherwise.
> It is a difference in functionality and we'll see if the something
> closer to the old way can be done.
> I've just verified this and Marc's going to go look at it.

In preliminary talking with Marc & Dan , it's the way the event
selector code works.

It's expected behavior from the new engine but it needs to be
documented in the manual
Chris Green <cmg at ...402...>
 "Not everyone holds these truths to be self-evident, so we've worked
                  up a proof of them as Appendix A." --  Paul Prescod

More information about the Snort-devel mailing list