[Snort-users] "Incomplete Fragments" logging wrong on HP-UX 10.20

Ralf Hildebrandt Ralf.Hildebrandt at ...821...
Sat Apr 28 07:36:27 EDT 2001


On Sat, Apr 07, 2001 at 02:41:37PM +0200, Ralf Hildebrandt wrote:

> It's me again, Ralf with the obscure OS form hell -- HP-UX 10.20.
> Again, running programs on HP-UX no admin was ever meant to run :)
> 
> Snort (CVS checkout from today -- and all old versions as well) reports:
> Apr  7 11:34:50 stahlw06 snort[28280]: Incomplete Packet Fragments Discarded: 52.220.134.169 -> 41.195.134.169
> 
> but I'm sure it's meant to be:
> 134.169.52.220 -> 134.169.41.195
> 
> So the first two bytes of an IP seem to be swapped with the last two bytes.

Any news on that? I'm running 1.8 beta now (running nice and stable, BTW),
but still I get these strange byte swappings...

-- 
ralf.hildebrandt at ...821...                            innominate AG
System Engineer                        Don't be afraid of what you see -
Diplom-Informatiker                     be afraid of what you don't see!
tel: +49.(0)7000.POSTFIX  fax: +49.(0)30.308806-698         

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 240 bytes
Desc: not available
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20010428/0b7e34fb/attachment.sig>


More information about the Snort-users mailing list