[Snort-devel] new pb on snort v2 ? (icmp large packet)

Chris Green cmg at ...402...
Wed Apr 23 08:03:33 EDT 2003


Chris Green <cmg at ...402...> writes:

> rmkml <rmkml at ...1042...> writes:
>
>> Hi,
>
> I get large ping requests if I comment out the icmp-info.rules, echo
> request/reply otherwise.
>
> It is a difference in functionality and we'll see if the something
> closer to the old way can be done.
>
> I've just verified this and Marc's going to go look at it.

In preliminary talking with Marc & Dan , it's the way the event
selector code works.

It's expected behavior from the new engine but it needs to be
documented in the manual
-- 
Chris Green <cmg at ...402...>
 "Not everyone holds these truths to be self-evident, so we've worked
                  up a proof of them as Appendix A." --  Paul Prescod




More information about the Snort-devel mailing list