Home page logo
/

snort logo Snort mailing list archives

Re: (snort_decoder) WARNING: IP dgm len > captured len!
From: Russ Combs <rcombs () sourcefire com>
Date: Wed, 3 Nov 2010 16:11:12 -0400

On Tue, Oct 12, 2010 at 9:07 AM, Martin Roecker <roecker () linogate de> wrote:

since were running snort in version 2.9.0 packets with a
bigger size than 1369 bytes are droped by snort. This happens
when we run snort in inline mode using the ipq daq.

UPDATE: when I start snort with "--snaplen 1518" it is working
fine. Is it possible that the length calculated is wrong?


The IPQ and NFQ DAQs had an internal buffer limitation that is fixed in the
latest release.


Martin



------------------------------------------------------------------------------
Beautiful is writing same markup. Internet Explorer 9 supports
standards for HTML5, CSS3, SVG 1.1,  ECMAScript5, and DOM L2 & L3.
Spend less time writing and  rewriting code and more time creating great
experiences on the web. Be a part of the beta today.
http://p.sf.net/sfu/beautyoftheweb
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

------------------------------------------------------------------------------
Achieve Improved Network Security with IP and DNS Reputation.
Defend against bad network traffic, including botnets, malware, 
phishing sites, and compromised hosts - saving your company time, 
money, and embarrassment.   Learn More! 
http://p.sf.net/sfu/hpdev2dev-nov
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]