port numbers missing from argus records
r.fulton at auckland.ac.nz
Wed Apr 20 01:13:18 EDT 2005
On Tue, 2005-04-19 at 19:03 -0700, Peter Van Epp wrote:
> Ah, the previous bug which begats the one this fix is for. \t is
> broken (as I recall the code \t isn't a valid delimiter I think it really
> wants cntrl-I in there) but by that time I had made this change and didn't
> worry about it.
Ah! indeed. I think I have found the problem:
in get_argus_string (file argus_util.c) a buffer is built for output
from the argus record. First there is a loop which writes the fields
into the buffer. Some of these fields are delimited by the RA_DELIMITER
others are separated by spaces (???? I'm sure Carter had a good reason
at the time :)
If the output is delimited then this is followed by another loop the
works its way down the buffer removing all strings of white space
( while (isspace((int)*str)) str++ )
and replacing them with a single delimiter. Thus if your delimiter is
'\t' two delimiters get replaced by one -- exactly what I was seeing.
I have replaced that line (argus_util:2888) by :
while (*str == ' ' ) str++;
which in the context is, I believe, functionally equivalent (and faster)
and will allow tabs as a delimiter.
I've had it running in parallel with the original version and it is now
correctly handling the "null" port records that the old version spits
I'm feeling quite pleased with myself :) It must be about 5 years since
I last delved into the guts of argus to fix a bug!
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 2201 bytes
Desc: not available
More information about the argus