[Snort-devel] new pb on snort v2 ? (icmp large packet)
rmkml at ...1042...
Wed Apr 23 08:07:36 EDT 2003
but how to make then ?
(for look icmp large packet event on snort v2)
Chris Green wrote:
> Chris Green <cmg at ...402...> writes:
> > rmkml <rmkml at ...1042...> writes:
> >> Hi,
> > I get large ping requests if I comment out the icmp-info.rules, echo
> > request/reply otherwise.
> > It is a difference in functionality and we'll see if the something
> > closer to the old way can be done.
> > I've just verified this and Marc's going to go look at it.
> In preliminary talking with Marc & Dan , it's the way the event
> selector code works.
> It's expected behavior from the new engine but it needs to be
> documented in the manual
> Chris Green <cmg at ...402...>
> "Not everyone holds these truths to be self-evident, so we've worked
> up a proof of them as Appendix A." -- Paul Prescod
More information about the Snort-devel