Snort mailing list archives
Re: snort 1.8.4b1 dumping core
From: Fyodor <fygrave () tigerteam net>
Date: Sun, 3 Feb 2002 14:05:17 +0700
On Sat, Feb 02, 2002 at 11:04:55PM -0800, Kris Kennaway wrote:
I've been corresponding with Fyodor a bit about this: I sent him the following gdb backtrace. (gdb) bt #0 0x280bab5f in ?? () #1 0x280ba7bb in ?? () #2 0x804c121 in InterfaceThread (arg=0x80bb000) at snort.c:1675 #3 0x804a841 in main (argc=50652, argv=0xfe8f7d04) at snort.c:478
[snip] [snip]
1675 if(pcap_loop(pds[myint], pv.pkt_cnt, (pcap_handler) ProcessPacket, NULL) < 0)
I'd recompile libpcap with -ggdb and give it a try, sounds like we are coredumping somewhere in libpcap. I am not on freeBSD box right now, and linux doesn't fail the same way :-/ (could be that pcap fails due to some params which we supply in pcap_*read() somewhere..)
1676 { 1677 if(pv.daemon_flag) 1678 syslog(LOG_CONS | LOG_DAEMON, "pcap_loop: %s", pcap_geterr(pd)); 1679 else (gdb) print myint $3 = 671896152
This is a stack-allocated variable, probably has been overwritten by something ;-) there's now it could be that big otherwise ;-p InterfaceThread() { static intnum = 0; int myint; myint = intnum; intnum++; ... _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- snort 1.8.4b1 dumping core Kris Kennaway (Feb 02)
- Re: snort 1.8.4b1 dumping core Martin Roesch (Feb 02)
- Re: snort 1.8.4b1 dumping core Kris Kennaway (Feb 02)
- Re: snort 1.8.4b1 dumping core Martin Roesch (Feb 02)
- Re: snort 1.8.4b1 dumping core Kris Kennaway (Feb 02)
- Re: snort 1.8.4b1 dumping core Fyodor (Feb 02)
- Re: snort 1.8.4b1 dumping core Martin Roesch (Feb 03)
- Re: snort 1.8.4b1 dumping core Kris Kennaway (Feb 03)
- Re: snort 1.8.4b1 dumping core Martin Roesch (Feb 03)
- Re: snort 1.8.4b1 dumping core Kris Kennaway (Feb 03)
- Re: snort 1.8.4b1 dumping core Fyodor (Feb 04)
- Re: snort 1.8.4b1 dumping core Kris Kennaway (Feb 15)
- Re: snort 1.8.4b1 dumping core Martin Roesch (Feb 15)
- Re: snort 1.8.4b1 dumping core Kris Kennaway (Feb 15)
- Re: snort 1.8.4b1 dumping core Martin Roesch (Feb 15)
- Re: snort 1.8.4b1 dumping core Kris Kennaway (Feb 02)
- Re: snort 1.8.4b1 dumping core Martin Roesch (Feb 02)