[Snort-devel] Question regarding Flowbits

Adayadil Thomas adayadil.thomas at ...2499...
Fri May 30 15:57:17 EDT 2008


Is there a reason for having 1 byte in FLOWDATA structure and the rest
allocated through hash table ?

Thanks

On Fri, May 30, 2008 at 2:49 PM, Steven Sturges
<steve.sturges at ...402...> wrote:
> There is a value giFlowbitSize that is configurable.  That is the
> size (in bytes) of the allocated space, either in Stream or in Flow
> preprocessor.
>
> The StreamFlowData strucuture has a single byte reference that is
> the 1st byte of the flowbit storage, yet the data that gets alloc'd
> is usually larger.
>
> Cheers.
> -steve
>
> Adayadil Thomas wrote:
>>
>> Greetings.
>>
>> I am looking through the source code of snort 2.8.1 and I am trying to
>> understand
>> the allocation for memory for flowbits data.
>>
>> If x bytes (x times 8 bits) are needed for flowbits data, how and
>> where the memory
>> is allocated? If you can specify the file/function that I am looking
>> for that would be great.
>>
>> Thanks
>> Aday
>>
>> -------------------------------------------------------------------------
>> This SF.net email is sponsored by: Microsoft
>> Defy all challenges. Microsoft(R) Visual Studio 2008.
>> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
>> _______________________________________________
>> Snort-devel mailing list
>> Snort-devel at lists.sourceforge.net
>> https://lists.sourceforge.net/lists/listinfo/snort-devel
>>
>




More information about the Snort-devel mailing list