[Snort-users] snort 2.0.2 with odbc

Secureplay secureplay at ...9090...
Thu Sep 25 23:26:03 EDT 2003


Sorry if this has been discussed, I'm a new user...

I'm trying to use Snort 2.0.2 with ODBC (to reach a MSSQL server). It
appears that it calls SQLRowCount() after a select statement. With FreeTDS,
this always returns 0
because (per spec:)

"If the last SQL statement executed on the statement handle was not an
UPDATE, INSERT, or DELETE statement or if the Operation argument in the
previous call to SQLBulkOperations was not SQL_ADD, SQL_UPDATE_BY_BOOKMARK,
or SQL_DELETE_BY_BOOKMARK, or if the Operation argument in the previous call
to SQLSetPos was not SQL_UPDATE or SQL_DELETE, the value of *RowCountPtr is
driver-defined. "  

This seems to me like a major issue which makes all selects fail. Another
issue would possibly be that it is not calling SQLCloseCursor():

"To execute a SELECT statement more than once, the application must call
SQLCloseCursor before reexecuting the SELECT statement."

Searching the archives, I found that at least the first one is a known
issue:

http://marc.theaimsgroup.com/?l=snort-devel&m=103893632212262&w=2 (dated
12/03/2002)

Is this patch available for the 2.x versions? Or is ODBC support left up to
luck, only to work for those who happen to have the right driver?

I would endeavor to do the patch if someone could tell me if my second
concern is warranted. But since I never worked with ODBC before, I am hoping
someone with more experience already did this.


Thanks,
-me






More information about the Snort-users mailing list