Snort -2.3.0 RC2 dumps core

["Senthil Prabu.S" <prabu333 () hotpop com>]

Hello Experts,
           
       I have just now upgraded snort to 2.3.0RC2 on my HP 11.11 machine.
I faced no problems during build process. It was a smooth install. Then I 
started testing all options. When I tested the -o option, bus error occured
and core was dumped.It happend after few minutes after starting snort. CPU
utilization was normal.

The command that I executed was,

snort -c /opt/iexpress/snort/etc/snort.conf -o

But I tested again without using snort.conf file,then it works well.

snort -l /var/log/snort -o

I also tested the previous stable version 2.2.0 on HP-UX 11.11. I tested above
said both options,I found no problem,it works well.

The problem is only with snort -2.3.0 RC2,that to when I use "-o" option along
with "-c" option.

Anyone can help in this issue??

Following are the details about the core:

# gdb snort core
HP gdb 4.5 for PA-RISC 1.1 or 2.0 (narrow), HP-UX 11.00
and target hppa1.1-hp-hpux11.00.
Copyright 1986 - 2001 Free Software Foundation, Inc.
Hewlett-Packard Wildebeest 4.5 (based on GDB) is covered by the
GNU General Public License. Type "show copying" to see the conditions to
change it and/or distribute copies. Type "show warranty" for warranty/support.
..(no debugging symbols found)...
Core was generated by `snort'.
Program terminated with signal 10, Bus error.
(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols 
found)...
(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols 
found)...
#0  0x71c84 in BuildPacket+0x19c ()
(gdb)
(gdb) bt
#0  0x71c84 in BuildPacket+0x19c ()
#1  0x715b8 in FlushStream+0xc0 ()
#2  0x728f4 in TcpAction+0x324 ()
#3  0x6d7c4 in ReassembleStream4+0x6ac ()
#4  0x3a5f0 in Preprocess+0xc0 ()
#5  0x31898 in ProcessPacket+0x1c0 ()
#6  0x17e63c in pcap_read_dlpi+0x19c ()
#7  0x71c28 in BuildPacket+0x140 ()
#8  0x3394c in InterfaceThread+0xa4 ()
#9  0x316a8 in SnortMain+0x990 ()
#10 0x30cac in main+0x2c ()

# file core
core:           core file from 'snort' - received SIGBUS


The pop-up window of snort is given below;
# ./snort -c ../etc/snort.conf -o
Running in IDS mode

Initializing Network Interface lan0

        --== Initializing Snort ==--
Rule application order changed to Pass->Alert->Log
Initializing Output Plugins!
Decoding Ethernet on interface lan0
Initializing Preprocessors!
Initializing Plug-ins!
Parsing Rules file ../etc/snort.conf

+++++++++++++++++++++++++++++++++++++++++++++++++++
Initializing rule chains...
,-----------[Flow Config]----------------------
| Stats Interval:  0
| Hash Method:     2
| Memcap:          10485760
| Rows  :          4099
| Overhead Bytes:  16400(%0.16)
`----------------------------------------------
No arguments to frag2 directive, setting defaults to:
    Fragment timeout: 60 seconds
    Fragment memory cap: 4194304 bytes
    Fragment min_ttl:   0
    Fragment ttl_limit: 5
    Fragment Problems: 0
    Self preservation threshold: 500
    Self preservation period: 90
    Suspend threshold: 1000
    Suspend period: 30
Stream4 config:
    Stateful inspection: ACTIVE
    Session statistics: INACTIVE
    Session timeout: 30 seconds
    Session memory cap: 8388608 bytes
    State alerts: INACTIVE
    Evasion alerts: INACTIVE
    Scan alerts: INACTIVE
    Log Flushed Streams: INACTIVE
    MinTTL: 1
    TTL Limit: 5
    Async Link: 0
    State Protection: 0
    Self preservation threshold: 50
    Self preservation period: 90
    Suspend threshold: 200
    Suspend period: 30
    Enforce TCP State: INACTIVE
    Midstream Drop Alerts: INACTIVE

Stream4_reassemble config:
    Server reassembly: INACTIVE
    Client reassembly: ACTIVE
    Reassembler alerts: ACTIVE
    Zero out flushed packets: INACTIVE
    flush_data_diff_size: 500
    Ports: 21 23 25 53 80 110 111 143 513 1433
    Emergency Ports: 21 23 25 53 80 110 111 143 513 1433
HttpInspect Config:
    GLOBAL CONFIG
      Max Pipeline Requests:    0
      Inspection Type:          STATELESS
      Detect Proxy Usage:       NO
      IIS Unicode Map Filename: ../etc/unicode.map
      IIS Unicode Map Codepage: 1252
    DEFAULT SERVER CONFIG:
      Ports: 80 8080 8180
      Flow Depth: 300
      Max Chunk Length: 500000
      Inspect Pipeline Requests: YES
      URI Discovery Strict Mode: NO
      Allow Proxy Usage: NO
      Disable Alerting: NO
      Oversize Dir Length: 500
      Only inspect URI: NO
      Ascii: YES alert: NO
      Double Decoding: YES alert: YES
      %U Encoding: YES alert: YES
      Bare Byte: YES alert: YES
      Base36: OFF
      UTF 8: OFF
      IIS Unicode: YES alert: YES
      Multiple Slash: YES alert: NO
      IIS Backslash: YES alert: NO
      Directory Traversal: YES alert: NO
      Web Root Traversal: YES alert: YES
      Apache WhiteSpace: YES alert: NO
      IIS Delimiter: YES alert: NO
      IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG
      Non-RFC Compliant Characters: NONE
rpc_decode arguments:
    Ports to decode RPC on: 111 32771
    alert_fragments: INACTIVE
    alert_large_fragments: ACTIVE
    alert_incomplete: ACTIVE
    alert_multiple_requests: ACTIVE
telnet_decode arguments:
    Ports to decode telnet on: 21 23 25 119
Portscan Detection Config:
    Detect Protocols:  TCP UDP ICMP IP
    Detect Scan Type:  portscan portsweep decoy_portscan distributed_portscan
    Sensitivity Level: Low
    Memcap (in bytes): 10000000
    Number of Nodes:   36900

2180 Snort rules read...
2180 Option Chains linked into 176 Chain Headers
0 Dynamic rules
+++++++++++++++++++++++++++++++++++++++++++++++++++

Warning: flowbits key 'realplayer.playlist' is checked but not ever set.

+-----------------------[thresholding-config]----------------------------------
| memory-cap : 1048576 bytes
+-----------------------[thresholding-global]----------------------------------
| none
+-----------------------[thresholding-local]-----------------------------------
| gen-id=1      sig-id=2523      type=Both       tracking=dst count=10  seconds=10
| gen-id=1      sig-id=2494      type=Both       tracking=dst count=20  seconds=60
| gen-id=1      sig-id=2495      type=Both       tracking=dst count=20  seconds=60
| gen-id=1      sig-id=2496      type=Both       tracking=dst count=20  seconds=60
| gen-id=1      sig-id=2923       type=Threshold tracking=src count=10  seconds=60
| gen-id=1      sig-id=2924       type=Threshold tracking=src count=10  seconds=60
| gen-id=1      sig-id=2275       type=Threshold tracking=dst count=5   seconds=60
+-----------------------[suppression]------------------------------------------
-------------------------------------------------------------------------------
Rule application order: ->pass->activation->dynamic->alert->log
Log directory = /var/log/snort

        --== Initialization Complete ==--

   ,,_     -*> Snort! <*-
  o"  )~   Version 2.3.0RC2 (Build 9)
   ''''    By Martin Roesch & The Snort Team: http://www.snort.org/team.html
           (C) Copyright 1998-2004 Sourcefire Inc, et al.

Bus error(coredump)






With Advance Thanks,
Senthil Prabu.S