Snort mailing list archives
Re: Segfault on fun funy rule
From: "Jason Monroe \"JC\"" <monroe () nas nasa gov>
Date: Thu, 26 Feb 2004 00:46:07 -0800
Ok Ok, don't burn me. I followed the FAQ and look where it got me ;) I use gdb once in never ;) This is what I meant to sent. For fear that snipping will decrease reproducibility I've included it all :D In this case bad stuff first: Program received signal SIGSEGV, Segmentation fault. 0x001a9153 in strlen () from /lib/tls/libc.so.6 (gdb) where #0 0x001a9153 in strlen () from /lib/tls/libc.so.6 #1 0x001a8e85 in strdup () from /lib/tls/libc.so.6 #2 0x0807bfe3 in ParseFlowArgs (data=0x0, otn=0x9e66ad8) at sp_clientserver.c:143 #3 0x0807bfc4 in FlowInit (data=0x0, otn=0x9e66ad8, protocol=6) at sp_clientserver.c:119 #4 0x08056ea4 in ParseRuleOptions ( rule=0xbfec0fb0 "alert tcp any any -> any any (msg:\"Telnet login as root\";content:\"root\";flow:from_client:established;", rule_type=2, protocol=6) at parser.c:1776 #5 0x08055703 in ParseRule (rule_file=0x9e65a48, prule=0xbfec3060 "alert tcp $EXTERNAL_NET any -> $TELNET_SERVERS any (msg:\"Telnet login as root\";content:\"root\";flow:from_client:established;)", inclevel=1) at parser.c:753 #6 0x08054870 in ParseRulesFile (file=0x9e65420 "/opt/snort/rules/local.rules", inclevel=1) at parser.c:254 #7 0x08054f6c in ParseRule (rule_file=0x9e40598, prule=0xbfec55b0 "include $RULE_PATH/local.rules", inclevel=0) at parser.c:525 #8 0x08054870 in ParseRulesFile (file=0x9e3ec60 "/etc/snort/snort.conf", inclevel=0) at parser.c:254 #9 0x0805cb2d in SnortMain (argc=5, argv=0xbfec5b24) at snort.c:480 #10 0x0805c572 in main (argc=5, argv=0xbfec5b24) at snort.c:168 (gdb) bt #0 0x001a9153 in strlen () from /lib/tls/libc.so.6 #1 0x001a8e85 in strdup () from /lib/tls/libc.so.6 #2 0x0807bfe3 in ParseFlowArgs (data=0x0, otn=0x9e66ad8) at sp_clientserver.c:143 #3 0x0807bfc4 in FlowInit (data=0x0, otn=0x9e66ad8, protocol=6) at sp_clientserver.c:119 #4 0x08056ea4 in ParseRuleOptions ( rule=0xbfec0fb0 "alert tcp any any -> any any (msg:\"Telnet login as root\";content:\"root\";flow:from_client:established;", rule_type=2, protocol=6) at parser.c:1776 #5 0x08055703 in ParseRule (rule_file=0x9e65a48, prule=0xbfec3060 "alert tcp $EXTERNAL_NET any -> $TELNET_SERVERS any (msg:\"Telnet login as root\";content:\"root\";flow:from_client:established;)", inclevel=1) at parser.c:753 #6 0x08054870 in ParseRulesFile (file=0x9e65420 "/opt/snort/rules/local.rules", inclevel=1) at parser.c:254 #7 0x08054f6c in ParseRule (rule_file=0x9e40598, prule=0xbfec55b0 "include $RULE_PATH/local.rules", inclevel=0) at parser.c:525 #8 0x08054870 in ParseRulesFile (file=0x9e3ec60 "/etc/snort/snort.conf", inclevel=0) at parser.c:254 #9 0x0805cb2d in SnortMain (argc=5, argv=0xbfec5b24) at snort.c:480 #10 0x0805c572 in main (argc=5, argv=0xbfec5b24) at snort.c:168 Now the Rest of IT (gdb) run -T -v -c /etc/snort/snort.conf Starting program: /opt/snort/bin/snort -T -v -c /etc/snort/snort.conf Running in IDS mode Log directory = /var/log/snort Initializing Network Interface eth0 --== Initializing Snort ==-- Initializing Output Plugins! Decoding Ethernet on interface eth0 Initializing Preprocessors! Initializing Plug-ins! ------------------------------------------------- Keyword | Preprocessor @ ------------------------------------------------- portscan : 0x8084559 portscan-ignorehosts: 0x8085033 rpc_decode : 0x80855e2 bo : 0x80807bf telnet_decode: 0x808f127 stream4 : 0x80870b3 stream4_reassemble: 0x8087bfa frag2 : 0x8081478 arpspoof : 0x807fd00 arpspoof_detect_host: 0x807fe1d conversation : 0x80903a5 portscan2 : 0x80931b8 portscan2-ignorehosts: 0x8091c3c portscan2-ignoreports-from: 0x8092059 portscan2-ignoreports-to: 0x8092079 http_inspect : 0x8096dc0 http_inspect_server: 0x8096dc0 PerfMonitor : 0x808f70f flow : 0x8099ad3 flow-portscan: 0x809aa4a ------------------------------------------------- ------------------------------------------------- Keyword | Plugin Registered @ ------------------------------------------------- content : 0x8078319 content-list : 0x807824c offset : 0x8078469 depth : 0x80785ae nocase : 0x8078709 rawbytes : 0x80787bd regex : 0x8078aa6 uricontent : 0x80783c1 distance : 0x8078812 within : 0x807895c flags : 0x807af47 itype : 0x80762fb icode : 0x8075a9f ttl : 0x807ba43 id : 0x8076f9b ack : 0x807ad87 seq : 0x807b623 dsize : 0x8075507 ipopts : 0x80777ff rpc : 0x8079fc7 icmp_id : 0x8075eeb icmp_seq : 0x80760f3 session : 0x807a66f tos : 0x807759b fragbits : 0x8076743 fragoffset : 0x8076c6c window : 0x807b7bd ip_proto : 0x8077153 sameip : 0x807741f flow : 0x807bf5b byte_test : 0x807c882 byte_jump : 0x807d46e isdataat : 0x807ebca pcre : 0x807def4 flowbits : 0x807f2cd ------------------------------------------------- ------------------------------------------------- Keyword | Output @ ------------------------------------------------- alert_syslog : 0x806de85 log_tcpdump : 0x8072735 database : 0x806fd3d alert_fast : 0x806d2f5 alert_full : 0x806d93d alert_unixsock: 0x806e8e5 alert_CSV : 0x806ede5 log_null : 0x8072671 log_unified : 0x8073c98 alert_unified: 0x80739f5 unified : 0x8072ccf log_ascii : 0x8074259 alert_sf_socket: 0x8074cfc alert_sf_socket_sid: 0x8074e01 ------------------------------------------------- Parsing Rules file /etc/snort/snort.conf +++++++++++++++++++++++++++++++++++++++++++++++++++ Initializing rule chains... ,-----------[Flow Config]---------------------- | Stats Interval: 0 | Hash Method: 2 | Memcap: 10485760 | Rows : 4099 | Overhead Bytes: 16400(%0.16) `---------------------------------------------- No arguments to frag2 directive, setting defaults to: Fragment timeout: 60 seconds Fragment memory cap: 4194304 bytes Fragment min_ttl: 0 Fragment ttl_limit: 5 Fragment Problems: 0 Self preservation threshold: 500 Self preservation period: 90 Suspend threshold: 1000 Suspend period: 30 Stream4 config: Stateful inspection: ACTIVE Session statistics: INACTIVE Session timeout: 30 seconds Session memory cap: 8388608 bytes State alerts: INACTIVE Evasion alerts: INACTIVE Scan alerts: INACTIVE Log Flushed Streams: INACTIVE MinTTL: 1 TTL Limit: 5 Async Link: 0 State Protection: 0 Self preservation threshold: 50 Self preservation period: 90 Suspend threshold: 200 Suspend period: 30 Stream4_reassemble config: Server reassembly: INACTIVE Client reassembly: ACTIVE Reassembler alerts: ACTIVE Zero out flushed packets: INACTIVE flush_data_diff_size: 500 Ports: 21 23 25 53 80 110 111 143 513 1433 Emergency Ports: 21 23 25 53 80 110 111 143 513 1433 HttpInspect Config: GLOBAL CONFIG Max Pipeline Requests: 0 Inspection Type: STATELESS Detect Proxy Usage: NO IIS Unicode Map Filename: /etc/snort/unicode.map IIS Unicode Map Codepage: 1252 DEFAULT SERVER CONFIG: Ports: 80 8080 8180 Flow Depth: 300 Max Chunk Length: 500000 Inspect Pipeline Requests: YES URI Discovery Strict Mode: NO Allow Proxy Usage: NO Disable Alerting: NO Oversize Dir Length: 500 Only inspect URI: NO Ascii: YES alert: NO Double Decoding: YES alert: YES %U Encoding: YES alert: YES Bare Byte: YES alert: YES Base36: OFF UTF 8: OFF IIS Unicode: YES alert: YES Multiple Slash: YES alert: NO IIS Backslash: YES alert: NO Directory: YES alert: NO Apache WhiteSpace: YES alert: YES IIS Delimiter: YES alert: YES IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG Non-RFC Compliant Characters: NONE rpc_decode arguments: Ports to decode RPC on: 111 32771 alert_fragments: INACTIVE alert_large_fragments: ACTIVE alert_incomplete: ACTIVE alert_multiple_requests: ACTIVE telnet_decode arguments: Ports to decode telnet on: 21 23 25 119 Program received signal SIGSEGV, Segmentation fault. 0x001a9153 in strlen () from /lib/tls/libc.so.6
Instead of "run snort ...." try just "run <options>" without the word 'snort'. Libpcap is seeing that and trying to interpret it as a BPF style filter, hence the syntax error with OpenPcap. Cheers! -----
------------------------------------------------------- SF.Net is sponsored by: Speed Start Your Linux Apps Now. Build and deploy apps & Web services for Linux with a free DVD software kit from IBM. Click Now! http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Segfault on fun funy rule Jason Monroe "JC" (Feb 25)
- Re: Segfault on fun funy rule Erek Adams (Feb 25)
- Re: Segfault on fun funy rule Jason Monroe "JC" (Feb 26)
- Re: Segfault on fun funy rule Erek Adams (Feb 25)