Snort mailing list archives
Re: Snort++ crashes abruptly
From: João Soares <joaosoares11 () hotmail com>
Date: Wed, 14 Dec 2016 15:39:58 +0000
Thanks for your fast reply. Is there any built-in option that does what you are asking? By stracing snort I got these results: ... (thousands and thousands of nanosleeps) nanosleep({0, 1000000}, NULL) = 0 nanosleep({0, 1000000}, NULL) = 0 nanosleep({0, 1000000}, NULL) = 0 nanosleep({0, 1000000}, NULL) = 0 nanosleep({0, 1000000}, NULL) = 0 nanosleep({0, 1000000}, NULL) = 0 nanosleep({0, 1000000}, <unfinished ...> +++ killed by SIGABRT +++ Executing snort with -v, doesn't give me any more info other than what I already provided: snort: /usr/local/src/snort3/src/service_inspectors/http_inspect/http_stream_splitter_reassemble.cc:208: virtual const StreamBuffer* HttpStreamSplitter::reassemble(Flow*, unsigned int, unsigned int, const uint8_t*, unsigned int, uint32_t, unsigned int&): Assertion `total <= MAX_OCTETS' failed. Aborted On 12/14/2016 02:23 PM, Russ wrote:
Ouch. Thanks for reporting this. Can you provide a full backtrace? On 12/14/16 9:15 AM, João Soares wrote:Hi everyone, I've just updated Snort++ to Version 3.0.0-a4 (Build 221) and it is crashing from time to time. I've collected the following errors: AppIdDbg failed to create a related flow for xxx.xx.xx.xx-0 -> yyy.yy.yy.yy-52094 17 (The crash does not happen here) snort: /usr/local/src/snort3/src/service_inspectors/http_inspect/http_stream_splitter_reassemble.cc:208: virtual const StreamBuffer* HttpStreamSplitter::reassemble(Flow*, unsigned int, unsigned int, const uint8_t*, unsigned int, uint32_t, unsigned int&): Assertion `total <= MAX_OCTETS' failed. (It crashes here) Does anyone have any idea why this is happening? If you need additional info, please reply, I will provide it ASAP. Best regards, João Soares ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, SlashDot.org! http://sdm.link/slashdot _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, SlashDot.org! http://sdm.link/slashdot _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, SlashDot.org! http://sdm.link/slashdot _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Snort++ crashes abruptly João Soares (Dec 14)
- Re: Snort++ crashes abruptly Russ (Dec 14)
- Re: Snort++ crashes abruptly João Soares (Dec 14)
- Re: Snort++ crashes abruptly Russ (Dec 14)
- Re: Snort++ crashes abruptly João Soares (Dec 14)
- Re: Snort++ crashes abruptly Russ (Dec 14)
- Re: Snort++ crashes abruptly João Soares (Dec 14)
- Re: Snort++ crashes abruptly Russ (Dec 14)