e1048a5d4e
Notable changes: * Consolidation of IPv6 -- now only a single build supports both IPv4 & IPv6, and removal of the IPv4 "only" code paths. * File API and improvements to file processing for HTTP downloads and email attachments via SMTP, POP, and IMAP to facilitate broader file support * Use of address space ID for tracking Frag & Stream connections when it is available with the DAQ * Logging of packet data that triggers PPM for post-analysis via Snort event * Decoding of IPv6 with PPPoE This commit also includes a patch to snort.conf that was done by myself with feedback from Markus. The snort.conf patch ensures that Snort will load the latest Snort ruleset since the rule files have been reorganized by upstream. It also excludes local.rules by default, since rule managers like Oinkmaster skip that file when downloading rules. Tested by Markus on i386 and sparc64, Rodolfo Gouveia on 5.2/amd64 with his own snort.conf, and myself on amd64 and i386. OK sthen@
16 lines
737 B
Plaintext
16 lines
737 B
Plaintext
$OpenBSD: patch-src_decode_h,v 1.3 2013/01/16 04:52:53 lteo Exp $
|
|
--- src/decode.h.orig Fri Sep 21 02:09:13 2012
|
|
+++ src/decode.h Tue Oct 9 22:18:48 2012
|
|
@@ -806,9 +806,9 @@ typedef struct _SLLHdr {
|
|
* Pflog1_Hdr: CVS = 1.3, DLT_OLD_PFLOG = 17, Length = 28
|
|
* Pflog2_Hdr: CVS = 1.8, DLT_PFLOG = 117, Length = 48
|
|
* Pflog3_Hdr: CVS = 1.12, DLT_PFLOG = 117, Length = 64
|
|
- * Pflog3_Hdr: CVS = 1.172, DLT_PFLOG = 117, Length = 100
|
|
+ * Pflog4_Hdr: CVS = 1.16, DLT_PFLOG = 117, Length = 100
|
|
*
|
|
- * Since they have the same DLT, Pflog{2,3}Hdr are distinguished
|
|
+ * Since they have the same DLT, Pflog{2,3,4}Hdr are distinguished
|
|
* by their actual length. The minimum required length excludes
|
|
* padding.
|
|
*/
|