[Snort-users] (snort_decoder) WARNING: IP dgm len > captured len!

Russ Combs rcombs at ...1935...
Wed Nov 3 16:11:12 EDT 2010


On Tue, Oct 12, 2010 at 9:07 AM, Martin Roecker <roecker at ...15003...> wrote:

> > since were running snort in version 2.9.0 packets with a
> > bigger size than 1369 bytes are droped by snort. This happens
> > when we run snort in inline mode using the ipq daq.
>
> UPDATE: when I start snort with "--snaplen 1518" it is working
> fine. Is it possible that the length calculated is wrong?
>

The IPQ and NFQ DAQs had an internal buffer limitation that is fixed in the
latest release.

>
> Martin
>
>
>
> ------------------------------------------------------------------------------
> Beautiful is writing same markup. Internet Explorer 9 supports
> standards for HTML5, CSS3, SVG 1.1,  ECMAScript5, and DOM L2 & L3.
> Spend less time writing and  rewriting code and more time creating great
> experiences on the web. Be a part of the beta today.
> http://p.sf.net/sfu/beautyoftheweb
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20101103/fd8c6cae/attachment.html>


More information about the Snort-users mailing list