Re: snort crash in TcpSessionCleanup

[Todd Wease <twease () sourcefire com>]

Please update to snort 2.8.6 and see if the problem persists.

On 05/20/2010 07:27 AM, Prithvi Telang wrote:
> Hi,
> I'm using sort engine 2.8.5
>  I have created my own directory structure with snort code  and using 
> these names.
> Source file paths are absolutely fine..
> -Thanks,
> Prithvi
>
>
> On Thu, May 20, 2010 at 3:52 PM, Todd Wease <twease () sourcefire com 
> <mailto:twease () sourcefire com>> wrote:
>
>     The paths to source files in the backtrace don't look correct. 
>     What version of snort are you using?
>
>
>     On 05/20/2010 02:31 AM, Prithvi Telang wrote:
> >     Hi All,
> >               i have configured snort as an application in FC11 linux
> >     and when i'm trying to
> >     to a http GET from a apache web server in FC11 i'm getting a
> >     snort crash continuously.
> >
> >     bt and snort.conf are pasted here FYI.
> >     any help is highly appriciated.
> >     Thanks,
> >     Prithvi
> >
> >     (gdb) bt
> >
> >     #0  0xb7348b39 in TcpSessionCleanup (lwssn=0x8d25028)
> >
> >         at /snort/common/src/snort_stream5_tcp.c:4056
> >
> >     #1  0xb7345009 in DeleteLWSession (sessionCache=0x80dbba8,
> >     ssn=0x8d25028,
> >
> >         delete_reason=0xb738cfdf "closed normally")
> >
> >         at snort/common/src/snort_stream5_session.c:625
> >
> >     #2  0xb734d59d in ProcessTcp (lwssn=0x8d25028, p=0xbffef230,
> >     tdb=0xbffef170,
> >
> >         s5TcpPolicy=0xb5395008)
> >
> >         at snort/common/src/snort_stream5_tcp.c:7770
> >
> >     #3  0xb7349574 in Stream5ProcessTcp (p=0xbffef230,
> >     lwssn=0x8d25028, s5TcpPolicy=0xb5395008,
> >
> >         skey=0xbffef1c0)
> >
> >         at snort/common/src/snort_stream5_tcp.c:4495
> >
> >     #4  0xb72cc474 in Stream5Process (p=0xbffef230, context=0x0)
> >
> >         at snort/common/src/spp_stream5.c:1099
> >
> >     #5  0xb72f241e in Preprocess (p=0xbffef230)
> >
> >         at snort/common/src/detect.c:172
> >
> >     #6  0x0804cee1 in ProcessPacket (user=0x0, pkthdr=0xb5498fa4,
> >
> >         pkt=0xb6f04084 <Address 0xb6f04084 out of bounds>, ft=0x0)
> >
> >         at snort/d_module/src/snort.c:1619
> >
> >     ---Type <return> to continue, or q <return> to quit---
> >
> >     #7  0x08050d07 in snort_pkt_process (msg=0xb70e87e8)
> >
> >         at snort/d_module/src/snort-netd.c:224
> >
> >     #8  0x08051557 in snort_init_complete ()
> >
> >         at snort/d_module/src/snort-netd.c:634
> >
> >     #9  0x0804cc0d in SnortMain (argc=0, argv=0x0)
> >
> >         at snort/d_module/src/snort.c:777
> >
> >     #10 0x0804cb4a in main (argc=-1253470300, argv=0x0)
> >
> >         at snort/d_module/src/snort.c:643
> >
> >
> >     ------------------------------------------------------------------------------
> >
> >        
> >
> >
> >     _______________________________________________
> >     Snort-users mailing list
> >     Snort-users () lists sourceforge net  <mailto:Snort-users () lists sourceforge net>
> >     Go to this URL to change user options or unsubscribe:
> >     https://lists.sourceforge.net/lists/listinfo/snort-users
> >     Snort-users list archive:
> >     http://www.geocrawler.com/redir-sf.php3?list=snort-users

------------------------------------------------------------------------------

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users