Bug with malformed host in filter
    elof2 at sentor.se 
    elof2 at sentor.se
       
    Mon Feb 25 09:02:47 EST 2013
    
    
  
Hi Carter!
I stumbled on to a bug when accidentally executing a ra command with an 
incomplete IP address.
Strangely enough, the error-detection make different descisions depending 
of its place in the filter string.
Example:
#ra -Zb -nr argus.log - host 10.10.10.10 and host 10
pid 1907 (ra), uid 0: exited on signal 11 (core dumped)
host 10.10.10.10 and host 10 filter syntax error
The filter "tcp and host 10" and other elements before "host 10" also 
fail.
However, a filter of just "host 10" by itself does not fail, nor does 
"host 10 and host 10.10.10.10"
(ra version 3.0.6.2)
/Elof
    
    
More information about the argus
mailing list