Snort mailing list archives

snort crash in TcpSessionCleanup


From: Prithvi Telang <prithvi100 () gmail com>
Date: Thu, 20 May 2010 12:01:12 +0530

Hi All,
          i have configured snort as an application in FC11 linux and when
i'm trying to
to a http GET from a apache web server in FC11 i'm getting a snort crash
continuously.
bt and snort.conf are pasted here FYI.
any help is highly appriciated.

Thanks,
Prithvi


(gdb) bt

#0  0xb7348b39 in TcpSessionCleanup (lwssn=0x8d25028)

    at /snort/common/src/snort_stream5_tcp.c:4056

#1  0xb7345009 in DeleteLWSession (sessionCache=0x80dbba8, ssn=0x8d25028,

    delete_reason=0xb738cfdf "closed normally")

    at snort/common/src/snort_stream5_session.c:625

#2  0xb734d59d in ProcessTcp (lwssn=0x8d25028, p=0xbffef230, tdb=0xbffef170,


    s5TcpPolicy=0xb5395008)

    at snort/common/src/snort_stream5_tcp.c:7770

#3  0xb7349574 in Stream5ProcessTcp (p=0xbffef230, lwssn=0x8d25028,
s5TcpPolicy=0xb5395008,

    skey=0xbffef1c0)

    at snort/common/src/snort_stream5_tcp.c:4495

#4  0xb72cc474 in Stream5Process (p=0xbffef230, context=0x0)

    at snort/common/src/spp_stream5.c:1099

#5  0xb72f241e in Preprocess (p=0xbffef230)

    at snort/common/src/detect.c:172

#6  0x0804cee1 in ProcessPacket (user=0x0, pkthdr=0xb5498fa4,

    pkt=0xb6f04084 <Address 0xb6f04084 out of bounds>, ft=0x0)

    at snort/d_module/src/snort.c:1619

---Type <return> to continue, or q <return> to quit---

#7  0x08050d07 in snort_pkt_process (msg=0xb70e87e8)

    at snort/d_module/src/snort-netd.c:224

#8  0x08051557 in snort_init_complete ()

    at snort/d_module/src/snort-netd.c:634

#9  0x0804cc0d in SnortMain (argc=0, argv=0x0)

    at snort/d_module/src/snort.c:777

#10 0x0804cb4a in main (argc=-1253470300, argv=0x0)

    at snort/d_module/src/snort.c:643

Attachment: snort.conf
Description:

------------------------------------------------------------------------------

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Current thread: