[Snort-users] "Incomplete Fragments" logging wrong on HP-UX 10.20

Ralf Hildebrandt Ralf.Hildebrandt at ...821...
Sat Apr 7 08:41:37 EDT 2001


Hi!

It's me again, Ralf with the obscure OS form hell -- HP-UX 10.20.
Again, running programs on HP-UX no admin was ever meant to run :)

Snort (CVS checkout from today -- and all old versions as well) reports:
Apr  7 11:34:50 stahlw06 snort[28280]: Incomplete Packet Fragments Discarded: 52.220.134.169 -> 41.195.134.169

but I'm sure it's meant to be:
134.169.52.220 -> 134.169.41.195

So the first two bytes of an IP seem to be swapped with the last two bytes.

-- 
ralf.hildebrandt at ...821...                            innominate AG
System Engineer                        Don't be afraid of what you see -
Diplom-Informatiker                     be afraid of what you don't see!
tel: +49.(0)7000.POSTFIX  fax: +49.(0)30.308806-698         





More information about the Snort-users mailing list