[Snort-users] the max limit in BPF filter

Joseph Chen cax0cn at ...11827...
Fri Jun 15 23:49:28 EDT 2007


Hi,list;
My test environment is snort-2.6.1.4, oracle 9.0, RH9.0 and RHEL AS4;
when I try to setup a bpf filter file which has 243 bytes, I got an error:

Jun 16 11:29:50 admin snort[2485]: database: oracle_error: ORA-01401:
inserted value too large for column
Jun 16 11:29:50 admin snort[2485]:         : query: INSERT INTO sensor
(hostname, interface, filter, detail, encoding, last_cid) VALUES ('
124.124.1.24','eth0','not (dst net 122.122.122) and not (dst net 121.121.121)
and not (dst net 20.20.20) and not (dst net 22.22.22) and not (dst net
222.222.222) and not (dst host 111.11.1.1) and  not (dst host
111.111.111.111) ',1,0, 0)
Jun 16 11:29:50 admin snort[2485]: database: Problem obtaining SENSOR ID
(sid) from depsight->sensor

after cheching the source code of snort-2.6.1.4, I found that the limitation
is from the SQL script, which is different from database type:

CREATE TABLE sensor ( sid     SERIAL,
                      hostname    TEXT,
                      interface   TEXT,
                      filter      TEXT,

NOTE THAT: the column of filter is TEXT here, while in MsSQL and Oracle it's
varchar(100), this caused the listed error.

my question is can I modify this setting to avoid the previous errors? does
it have any disadvantage to snort?

thanks,
joseph
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20070616/21b03d54/attachment.html>


More information about the Snort-users mailing list