[Snort-users] Snort dont understand pf (openbsd) format

Christian Robottom Reis kiko at ...12725...
Tue Nov 30 10:19:09 EST 2004

On Tue, Nov 30, 2004 at 11:44:03AM -0500, Matt Kettler wrote:
> >I'm not sure which version of OpenBSD changed the format, but there is a 
> >new and an old format in OpenBSD 3.5's if_pflog.h. Snort's handling code 
> >matches the old format.
> Did a bit of digging. snort's pflog format matches the one used by OpenBSD 
> 3.3, but not 3.4 or newer
> http://www.openbsd.org/cgi-bin/cvsweb/src/sys/net/if_pflog.h

Thanks Matt. I was almost sure there was a real issue there; we had
testing on OpenBSD before and I had seen the results.

> rev 1.7 was used in 3.3 and only has one pflog header format.
> Rev 1.8 introduced the change.
> It appears that the old format goes with bpf.h's datalink type DLT_OLD_PFLG 
> (17), but the new one goes with DLT_PFLOG (117). Unfortunately, in OpenBSD 
> 3.3 the old format is DLT_PFLOG (17).
> Probably need to do some weird ifdefs to properly patch snort to deal with 
> both old and new systems. If DLT_OLD_PFLG isn't defined, it's the only 
> pflog format, if it is, you can support both old and new.

Okay, so either we get some diffs moving or we get the clients to
downgrade OpenBSD. Fun, fun.

Let's see if I can convince Breno to hack some snort code, and maybe we
will have some patches against head to get us going. It is certainly an
unexpected error, and I thought more people would have run into it, but
maybe not.

Take care,
Christian Robottom Reis | http://async.com.br/~kiko/ | [+55 16] 3361 2331

More information about the Snort-users mailing list