[Snort-users] "Incomplete Fragments" logging wrong on HP-UX 10.20

Martin Roesch roesch at ...421...
Mon Apr 9 00:57:43 EDT 2001


Sounds like a job for Dragos... :)

    -Marty

Ralf Hildebrandt wrote:
> 
> Hi!
> 
> It's me again, Ralf with the obscure OS form hell -- HP-UX 10.20.
> Again, running programs on HP-UX no admin was ever meant to run :)
> 
> Snort (CVS checkout from today -- and all old versions as well) reports:
> Apr  7 11:34:50 stahlw06 snort[28280]: Incomplete Packet Fragments Discarded: 52.220.134.169 -> 41.195.134.169
> 
> but I'm sure it's meant to be:
> 134.169.52.220 -> 134.169.41.195
> 
> So the first two bytes of an IP seem to be swapped with the last two bytes.
> 
> --
> ralf.hildebrandt at ...821...                            innominate AG
> System Engineer                        Don't be afraid of what you see -
> Diplom-Informatiker                     be afraid of what you don't see!
> tel: +49.(0)7000.POSTFIX  fax: +49.(0)30.308806-698
> 
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users




More information about the Snort-users mailing list