[Snort-users] the max limit in BPF filter
cax0cn at ...11827...
Fri Jun 15 23:49:28 EDT 2007
My test environment is snort-18.104.22.168, oracle 9.0, RH9.0 and RHEL AS4;
when I try to setup a bpf filter file which has 243 bytes, I got an error:
Jun 16 11:29:50 admin snort: database: oracle_error: ORA-01401:
inserted value too large for column
Jun 16 11:29:50 admin snort: : query: INSERT INTO sensor
(hostname, interface, filter, detail, encoding, last_cid) VALUES ('
22.214.171.124','eth0','not (dst net 122.122.122) and not (dst net 121.121.121)
and not (dst net 20.20.20) and not (dst net 22.22.22) and not (dst net
222.222.222) and not (dst host 126.96.36.199) and not (dst host
188.8.131.52) ',1,0, 0)
Jun 16 11:29:50 admin snort: database: Problem obtaining SENSOR ID
(sid) from depsight->sensor
after cheching the source code of snort-184.108.40.206, I found that the limitation
is from the SQL script, which is different from database type:
CREATE TABLE sensor ( sid SERIAL,
NOTE THAT: the column of filter is TEXT here, while in MsSQL and Oracle it's
varchar(100), this caused the listed error.
my question is can I modify this setting to avoid the previous errors? does
it have any disadvantage to snort?
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-users