Re: Coredumps from snort

[Martin Roesch <roesch () sourcefire com>]

Hi Suresh,
     Can you give me the full data dump from your Snort run (as
requested in the BUGS file) and include the stdout output that you get
when Snort runs?  If you're running Snort in daemon mode, please do a
straight run (non-daemon) with your standard setup and send me the
output.  Thanks.

    -Marty

Suresh Rajagopalan wrote:
> I've been getting a coredump in snort, apparently from spp_stream4.c. This
> is in the 1.8 revisions of snort (I never ran 1.7), upto rc1 released
> yesterday. Is there a fix for this? I'm running RH 7.1 with the 2.4.5
> kernel.
>
> Thanks
> -Suresh
>
> ---------------------------
> #0  0x7d110179 in ?? ()
> #1  0x08077443 in FlushStream (s=0x860dab0, p=0xbffff400, direction=0) at
> spp_stream4.c:2648
> #2  0x080757fa in ReassembleStream4 (p=0xbffff400) at spp_stream4.c:1178
> #3  0x0805681a in Preprocess (p=0xbffff400) at rules.c:3429
> #4  0x0804bc4f in ProcessPacket (user=0x0, pkthdr=0xbffff8c0, pkt=0x80d4632
> "") at snort.c:534
> #5  0x080796e0 in pcap_read () at eval.c:41
> #6  0x0807a0bf in pcap_loop () at eval.c:41
> #7  0x0804d043 in InterfaceThread (arg=0x0) at snort.c:1561
> #8  0x0804bb1f in main (argc=6, argv=0xbffffaa4) at snort.c:467
> #9  0x401de177 in __libc_start_main (main=0x804b4a0 <main>, argc=6,
> ubp_av=0xbffffaa4,
>     init=0x804a7cc <_init>, fini=0x8083ab0 <_fini>, rtld_fini=0x4000e184
> <_dl_fini>, stack_end=0xbffffa9c)
>     at ../sysdeps/generic/libc-start.c:129
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

--
Martin Roesch
roesch () sourcefire com
http://www.sourcefire.com - http://www.snort.org

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users