Re: Problem reporting PIDs with IDMEF

At 09:48 AM 7/23/2002, David A. Curry wrote:
>On a separate note, I'm still curious about Laura's more-than-32-bit PIDs.
>Win2k is a 32-bit o/s, right?  So unless they're using 64-bit data types
>for PIDs (which seems unlikely), PIDs should fit in 32 bits.  Laura, are
>you sure the data you're getting (or the things reporting the data) aren't
>broken?  (Of course, even if they are broken, you may not be able to do
>anything about it.)

I'm pretty sure it's broken. I've never seen a valid PID that couldn't fit 
in a 16-bit integer. This is the PID as reported in the Windows 2000 event 
log after a buffer overflow attack. Enough said. :-(