[Bro] a bug in CheckPIA_FirstPacket()?

lgh lgh at gradinfo.net.edu.cn
Sun Nov 5 08:17:27 PST 2006


Hi,
    In function TCP_Analyzer::CheckPIA_FirstPacket(), I assume the
testbit of first_packet_seen should be set when the first packet for
that direction is met. However, currently, one direction clears the
testbit of the other direction. If my guess is correct, the code should
be changed from:
    first_packet_seen = ORIG;
    ...
    first_packet_seen = RESP;
to
    first_packet_seen |= ORIG;
    ...
    first_packet_seen |= RESP;

cheers,

Guohan Lu



More information about the Bro mailing list