[Snort-users] diff between IpLen and DgmLen?

SW s.wun at ...6605...
Tue Aug 13 00:12:01 EDT 2002


is dgmlen the payload length?
Thansk
Sam
----- Original Message -----
From: "Matt Kettler" <mkettler at ...4108...>
To: "SW" <s.wun at ...6605...>; <snort-users at lists.sourceforge.net>
Sent: Tuesday, August 13, 2002 12:22 PM
Subject: Re: [Snort-users] diff between IpLen and DgmLen?


> IpLen (20 in most cases where no IP options are specifed) is the IP header
> length. IP header options are rarely used, unlike TCP options which are
> quite common. Very few routers will honor IP header options like
> source-route nowdays.
>
> dgmlen is the total datagram (packet) length.
>
> Both values are contained in the IP header of all packets. the IPLen is a
> 4-bit value and is in increments of 4 bytes (ie, max header length = 15*4
=
> 60), the dgmlen is a 16bit field in bytes.
>
> At 11:41 AM 8/13/2002 +0800, SW wrote:
> >Hi,
> >
> >I found there are two diffferent length in each msg in the alert file.
> >What is the difference between IpLen and DgmLen?
> >
> >Thanks
> >SW
>
>






More information about the Snort-users mailing list