Vulnerability Development: Re: [Snort-users] Re: snort crash ...

[MMS26 <mms () SPEAKEASY ORG>]

On Thu, 3 Aug 2000, Fyodor wrote:

> ~ :> Marty  has fixed some issues  with icmp handling as well and these have
> ~ :> been integrated into version 1.6.3. I am currently trying to integrate
> ~ :> those fixes into current version as well, and it should show up in cvs
> ~ :> tree as soon as I am done.
> ~ :>
> ~ :
> ~ :sorry for the crosspost... i am still unclear as to why snort 1.6.3 needs
> ~ :to open a raw socket at all... regardless of its lack of igm usage...
> ~ :
>
>  Raw socket? it's only needed if you use flexresp feature (which is not
> enabled by default) and is used to spoof `rst' or `icmp portunreach'
> packets, otherwise we use lipcap routines to read the data from datalink.
>
>
> if that helps..
much. i was concerned that some1 might have introduced something into cvs.
thanks!

MMS26