snort3: Active: active.device is mandatory
Meridoff via Snort-devel <[email protected]> Tue, 15 Oct 2019 14:08:50 +0300
| Newsgroups | gmane.comp.security.ids.snort.devel |
|---|---|
| Message-ID | <CAFfuDwy5vnhO0Rg+NWsGSN-CmhPF7Cd0gFHusnwES_G3QjjFyw@mail.gmail.com> |
--===============5712828166872966881==
Content-Type: multipart/alternative; boundary="000000000000015e100594f1039c"
--000000000000015e100594f1039c
Content-Type: text/plain; charset="UTF-8"
Hello, if I not configured active.device we have in Active::open (char
*dev) :
* if ( dev && strcasecmp(dev, "ip") )*
* {*
* s_link = eth_open(dev);*
*...*
So here we trying to eth_open for empty device.
May be change for that if no device specifed - we using "ip":
For example:
* if ( dev && strlen(dev) && strcasecmp(dev, "ip") )*
* {*
* s_link = eth_open(dev);*
...
--000000000000015e100594f1039c
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr">Hello, if I not configur=
ed active.device we have in Active::open (char *dev) :<div><i><br></i></div=
><div><div><i>=C2=A0 =C2=A0 if ( dev && strcasecmp(dev, "ip&qu=
ot;) )</i></div><div><i>=C2=A0 =C2=A0 {</i></div><div><i>=C2=A0 =C2=A0 =C2=
=A0 =C2=A0 s_link =3D eth_open(dev);</i></div></div><div><i>...</i></div><d=
iv>So here we trying to eth_open for empty device.</div><div><br></div><div=
>May be change for that if no device specifed - we using "ip":</d=
iv><div><br></div><div><div>For example:</div><div><div><i>=C2=A0 =C2=A0 if=
( dev && strlen(dev) =C2=A0&& strcasecmp(dev, "ip&quo=
t;) )</i></div><div><i>=C2=A0 =C2=A0 {</i></div><div><i>=C2=A0 =C2=A0 =C2=
=A0 =C2=A0 s_link =3D eth_open(dev);</i></div></div><div><br></div><div>...=
</div></div></div></div></div>
--000000000000015e100594f1039c--
--===============5712828166872966881==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.snort.org/mailman/listinfo/snort-devel
Please visit http://blog.snort.org for the latest news about Snort!
--===============5712828166872966881==--