[Snort-users] Re: snort crash ...
fygrave at ...121...
Wed Aug 2 17:48:58 EDT 2000
~ :> Marty has fixed some issues with icmp handling as well and these have
~ :> been integrated into version 1.6.3. I am currently trying to integrate
~ :> those fixes into current version as well, and it should show up in cvs
~ :> tree as soon as I am done.
~ :sorry for the crosspost... i am still unclear as to why snort 1.6.3 needs
~ :to open a raw socket at all... regardless of its lack of igm usage...
Raw socket? it's only needed if you use flexresp feature (which is not
enabled by default) and is used to spoof `rst' or `icmp portunreach'
packets, otherwise we use lipcap routines to read the data from datalink.
if that helps..
More information about the Snort-users