[Snort-users] IP Header Data Type Preference
L. Christopher Luther
CLuther at ...6333...
Fri May 16 13:31:13 EDT 2003
MySQL provides a function that will decode the INT representation of an IP
address and return a decimal-dotted string. Check out the INET_NTOA()
function in the MySQL docs .
From: David Markle [mailto:davidmarkle at ...5068...]
Sent: Friday, May 16, 2003 3:32 PM
To: Snort-users at lists.sourceforge.net
Subject: [Snort-users] IP Header Data Type Preference
I need some advice on IP Header Data types with a database, say MySQL. The
MySQL snort database defines IP address information as INT (integer) (i.e.
ip_src/ip_dst in the iphdr table). Is there a computational benefit to this
within the database or does it really matter.
For example, I could define ip_src (source IP Address) as CHAR(15) rather
than INT. This would preserve the quad dotted notation in the address. The
INT definition does not preserve this. I guess this is my problem. If the
field does not preserve the dotted notation, how is it addressed in
processing ??? Short uses INT field definitions for ip_src and ip_dst in
the iphdr table. How is it ultimately references as xxx.xxx.xxx.xxx after
its placed into the database ???
Thanks in advance.
Enterprise Linux Forum Conference & Expo, June 4-6, 2003, Santa Clara
The only event dedicated to issues related to Linux enterprise solutions
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:
More information about the Snort-users