[Snort-devel] Strange behaviour of inet_ntop...

Salvo Danilo Giuffrida salvodanilogiuffrida at ...2499...
Tue Jun 17 10:15:38 EDT 2008

Hello, I have this piece of code in my preprocessor:
if(inet_ntop(AF_INET, &(packet->iph->ip_src), rule.ip.src_addr,
(socklen_t) INET_ADDRSTRLEN) == NULL)
            ErrorMessage("Error during the reading of the packet's IP
            sprintf(rule.ip.src_port, "%u", packet->tcph->th_sport);

if(inet_ntop(AF_INET, &(packet->iph->ip_dst), rule.ip.dst_addr,
(socklen_t) INET_ADDRSTRLEN) == NULL)

The strange thing is that the 2nd call to inet_ntop returns the
destination address reversed! Instead of being '' it's
''. Now, I know of the whole big-endian vs little-endian,
network byte order, etc...but if that would be a bug of inet_ntop,
then also the 1st call would return a reversed ip, while it's not.
Have you ever had this problem?

More information about the Snort-devel mailing list