mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
TCP Reassembler hotfix for conns > 2GB.
The TCP Reassembler does not deliver any data to analyzers after the first 2GB due to signed integer overflow (Actually it will deliver again between 4--6GB, etc.) This happens silently, i.e., without content_gap events or Undelivered calls. See Comments in TCP_Reassembler.cc for more details. As a hotfix that seems to work I disabled the seq_to_skip features. It wasn't used by any analyzer or policy script (Note, that seq_to_skip is different from skip_deliveries). See also ticket #348
This commit is contained in:
parent
d24f7a6aad
commit
a5632aff4e
4 changed files with 74 additions and 16 deletions
|
@ -11,7 +11,7 @@
|
|||
class DataBlock {
|
||||
public:
|
||||
DataBlock(const u_char* data, int size, int seq,
|
||||
DataBlock* next, DataBlock* prev);
|
||||
DataBlock* prev, DataBlock* next);
|
||||
|
||||
~DataBlock();
|
||||
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue