[Snort-users] Snort swapping src and dst in binary log?

David Gordon dgordon at ...8400...
Thu Jul 10 07:29:21 EDT 2003

> If you have data on this, _please_ submit it.  The best thing 
> would be a
> pcap of the packets from tcpdump with a 65535 snaplen and 
> pcap from snort
> with the switched packets.  If you (or anyone else) have that 
> info, please
> send it to the snort-devel list.  If you don't want to send 
> your pcap info
> to the world, please contact a team member privately with the info.
> Thanks!

Thanks for the reply. This thing really had me questioning myself.

I should be able to set up a second system to capture this. If I'm
successful, I'll contact you to find out whom I should send the data to.


More information about the Snort-users mailing list