RE: Snort swapping src and dst in binary log?

[David Gordon <dgordon () mmwec org>]

> If you have data on this, _please_ submit it.  The best thing 
> would be a
> pcap of the packets from tcpdump with a 65535 snaplen and 
> pcap from snort
> with the switched packets.  If you (or anyone else) have that 
> info, please
> send it to the snort-devel list.  If you don't want to send 
> your pcap info
> to the world, please contact a team member privately with the info.
>
> Thanks!

Thanks for the reply. This thing really had me questioning myself.

I should be able to set up a second system to capture this. If I'm
successful, I'll contact you to find out whom I should send the data to.

David


-------------------------------------------------------
This SF.Net email sponsored by: Parasoft
Error proof Web apps, automate testing & more.
Download & eval WebKing and get a free book.
www.parasoft.com/bulletproofapps
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users