Re: Missing value in manual definition of u2 packet record

      Hi fearnothing

     Thanks for reporting this issue. It will be fixed in the next release.

     Thanks

[http://www.cisco.com/web/europe/images/email/signature/logo05.jpg]

Rahul Burman
ENGINEER.SOFTWARE ENGINEERING
[email protected]
Phone: +91 80 4365 7902

Cisco Systems Limited
SEZ, Embassy Tech Village,Panathur Varthur Hobli, Bangalore East Taluk
BANGALORE
KARNATAKA
560 037
IN
Cisco.com<http://www.cisco.com>





[Think before you print.]Think before you print.

This email may contain confidential and privileged material for the sole use of the intended recipient. Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive for the recipient), please contact the sender by reply email and delete all copies of this message.
For corporate legal information go to:
http://www.cisco.com/web/about/doing_business/legal/cri/index.html



From: fear nothing [mailto:[email protected]]
Sent: Monday, August 17, 2015 11:41 PM
To: [email protected]
Subject: [Snort-devel] Missing value in manual definition of u2 packet record

I believe I have found an error in the manual.snort.org documentation for the unified2 output. Specifically, the structure for Unified2 Packet records<http://manual.snort.org/node44.html#SECTION00632000000000000000> is currently:

    sensor id               4 bytes

    event id                4 bytes

    event seconds           4 bytes

    event microseconds      4 bytes

    linktype                4 bytes

    packet length           4 bytes

    packet data             <variable length>

The actual output of my device (currently running 2.9.7.3) is more accurately represented by:

    sensor id               4 bytes

    event id                4 bytes

    event second            4 bytes

    packet second           4 bytes

    packet microsecond      4 bytes

    linktype                4 bytes

    packet length           4 bytes

    packet data             <variable length>

The c header<https://github.com/jasonish/snort/blob/master/src/sfutil/Unified2_common.h#L135> seems to support this belief. It's a small thing but could save headaches for the next person crazy enough to start parsing the unified2 output themselves :)

Regards,
fearnothing
github.com/scherma

------------------------------------------------------------------------------

_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/snort-devel
Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel

Please visit http://blog.snort.org for the latest news about Snort!