Re: Bus error on sparc

[Michael Bell <michael.bell () cms hu-berlin de>]

Hi all,

I debug a little bit with gdb and see that snort always crashs with 
activated stream4 in decode.c at DecodeUDP line 2329.

This is the first time where the function accesses the ip header 
(p->iph->...). The surprising thing is that this code only crashs with 
activated stream4 but stream4 should never access a package which is not 
tcp. So has somebody an idea why stream4 does anything with a udp packet?

I find a function NotForStream4 which checks for an existent tcp header. 
Is it possible that this header is not NULL even if it is a udp packet?

Greetings Michael

P.S. should I ask such questions on snort-devel?
--
-------------------------------------------------------------------
Michael Bell                   Email: michael.bell () cms hu-berlin de
ZE Computer- und Medienservice            Tel.: +49 (0)30-2093 2482
(Computing Centre)                        Fax:  +49 (0)30-2093 2704
Humboldt-University of Berlin
Unter den Linden 6
10099 Berlin                   Email (private): michael.bell () web de
Germany                                       http://www.openca.org



-------------------------------------------------------
Enterprise Linux Forum Conference & Expo, June 4-6, 2003, Santa Clara
The only event dedicated to issues related to Linux enterprise solutions
www.enterpriselinuxforum.com

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users