Re: snort crash ...

[Fyodor <fygrave () SCORPIONS NET>]

> corruption problem.  The important thing to check on this crash is
> whether the defragmention preprocessor was enabled, (if so then likely
> this problem has been fixed, in the latest beta 14 of the defragger).
> If not there is a known issue with some icmp/igmp handling ... some

We don't handle igmp nor anything else except for udp, tcp and icmp in any
kind of specific way. The problem which has been spotted `sits' in
defragmentation preprocessor which is still beta anyway :).

Marty  has fixed some issues  with icmp handling as well and these have
been integrated into version 1.6.3. I am currently trying to integrate
those fixes into current version as well, and it should show up in cvs
tree as soon as I am done.

I've been told by Fabio that he is still having snort crashing after
upgrading spp_defrag.c to the lattest release, but I never managed to
repeat the problem myslef (tested on FeeBSD 4.x and R.H. linux 6.x). If
anyone manages to get it crashed, coredump files would be appreciated
mucho ;-) (please also include platform specific information and make sure
you test it with the lattest stable release).


Any questions and comments are welcome to be mailed to
snort-users () lists sourceforge net :-)

cheers,
 -F