[Snort-devel] new pb on snort v2 ? (icmp large packet)

rmkml rmkml at ...1042...
Wed Apr 23 08:07:36 EDT 2003


but how to make then ?
(for look icmp large packet event on snort v2)



Chris Green wrote:

> Chris Green <cmg at ...402...> writes:
>
> > rmkml <rmkml at ...1042...> writes:
> >
> >> Hi,
> >
> > I get large ping requests if I comment out the icmp-info.rules, echo
> > request/reply otherwise.
> >
> > It is a difference in functionality and we'll see if the something
> > closer to the old way can be done.
> >
> > I've just verified this and Marc's going to go look at it.
>
> In preliminary talking with Marc & Dan , it's the way the event
> selector code works.
>
> It's expected behavior from the new engine but it needs to be
> documented in the manual
> --
> Chris Green <cmg at ...402...>
>  "Not everyone holds these truths to be self-evident, so we've worked
>                   up a proof of them as Appendix A." --  Paul Prescod





More information about the Snort-devel mailing list