Snort mailing list archives
RE: Coredumps from snort
From: Suresh Rajagopalan <srajagopalan () williamoneil com>
Date: Wed, 15 Aug 2001 10:05:37 -0700
Hi, I changed snort to *not* run as root, and this appears to have gone away. I'm not sure why that would make a difference, though. -Suresh -----Original Message----- From: Martin Roesch [mailto:roesch () sourcefire com] Sent: Tuesday, August 14, 2001 8:59 AM To: Suresh Rajagopalan Cc: snort-users () lists sourceforge net Subject: Re: [Snort-users] Coredumps from snort Hi Suresh, Can you give me the full data dump from your Snort run (as requested in the BUGS file) and include the stdout output that you get when Snort runs? If you're running Snort in daemon mode, please do a straight run (non-daemon) with your standard setup and send me the output. Thanks. -Marty Suresh Rajagopalan wrote:
I've been getting a coredump in snort, apparently from spp_stream4.c. This is in the 1.8 revisions of snort (I never ran 1.7), upto rc1 released yesterday. Is there a fix for this? I'm running RH 7.1 with the 2.4.5 kernel. Thanks -Suresh --------------------------- #0 0x7d110179 in ?? () #1 0x08077443 in FlushStream (s=0x860dab0, p=0xbffff400, direction=0) at spp_stream4.c:2648 #2 0x080757fa in ReassembleStream4 (p=0xbffff400) at spp_stream4.c:1178 #3 0x0805681a in Preprocess (p=0xbffff400) at rules.c:3429 #4 0x0804bc4f in ProcessPacket (user=0x0, pkthdr=0xbffff8c0,
pkt=0x80d4632
"") at snort.c:534 #5 0x080796e0 in pcap_read () at eval.c:41 #6 0x0807a0bf in pcap_loop () at eval.c:41 #7 0x0804d043 in InterfaceThread (arg=0x0) at snort.c:1561 #8 0x0804bb1f in main (argc=6, argv=0xbffffaa4) at snort.c:467 #9 0x401de177 in __libc_start_main (main=0x804b4a0 <main>, argc=6, ubp_av=0xbffffaa4, init=0x804a7cc <_init>, fini=0x8083ab0 <_fini>, rtld_fini=0x4000e184 <_dl_fini>, stack_end=0xbffffa9c) at ../sysdeps/generic/libc-start.c:129 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: http://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
-- Martin Roesch roesch () sourcefire com http://www.sourcefire.com - http://www.snort.org _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: http://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Coredumps from snort Suresh Rajagopalan (Aug 14)
- Re: Coredumps from snort Martin Roesch (Aug 14)
- <Possible follow-ups>
- RE: Coredumps from snort Suresh Rajagopalan (Aug 15)