[Snort-users] Snort 1.8.7 (Unaligned access)
mkettler at ...4108...
Thu Jul 11 13:34:04 EDT 2002
I'm not super-educated on the subject, but here's what little I know about
the subject. Perhaps someone else has a better idea than I...
In general an Unaligned access like that means that a structure member was
accessed at a memory alignment that was not an even multiple of it's size.
Most 32 bit processors are tolerant of this, most 64bit ones are not and it
causes a processor exception.
For example, if I had a structure consisting of:
4byte field n1
1 byte field b1
4byte field n2
and the whole structure was forced to be single-byte aligned, accessing n2
causes an exception on any processor with strict alignment rules (ie: some
64bit ones and a few 32bit risc ones), but is perfectly fine on most
byte-oriented 32bit processors.
Most of the time structures are declared without specific alignment so if
needed the compiler inserts padding bytes so that all members are accessed
in proper alignment.
Why snort would have such an alignment issue isn't clear to me. TCP/IP
headers are all aligned pretty well, and those are likely to be the only
packed structs needed in snort.
At 02:51 PM 7/11/2002 -0400, Darryl Cook wrote:
>I have installed snort 1.8.7 on a Tru64 5.1 box and get the following
>when I run snort...
>Unaligned access pid=55588 <snort> va=etc etc inst=etc etc
>I get lots of these .... snort seems to run ok though.
>Any ideas of what may be causing this?
>This sf.net email is sponsored by:ThinkGeek
>PC Mods, Computing goodies, cases & more
>Snort-users mailing list
>Snort-users at lists.sourceforge.net
>Go to this URL to change user options or unsubscribe:
>Snort-users list archive:
More information about the Snort-users