[Snort-devel] new pb on snort v2 ? (icmp large packet)
cmg at ...402...
Wed Apr 23 08:03:33 EDT 2003
Chris Green <cmg at ...402...> writes:
> rmkml <rmkml at ...1042...> writes:
> I get large ping requests if I comment out the icmp-info.rules, echo
> request/reply otherwise.
> It is a difference in functionality and we'll see if the something
> closer to the old way can be done.
> I've just verified this and Marc's going to go look at it.
In preliminary talking with Marc & Dan , it's the way the event
selector code works.
It's expected behavior from the new engine but it needs to be
documented in the manual
Chris Green <cmg at ...402...>
"Not everyone holds these truths to be self-evident, so we've worked
up a proof of them as Appendix A." -- Paul Prescod
More information about the Snort-devel