Snort 2.4 + Stream4 + HDLC

[Eric Hines <eric.hines () appliedwatch com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Can anyone tell me if their are problems with Snort 2.4.4's stream4
preprocessor and HDLC frames?

We have Snort hanging off an OC line watching HDLC traffic. When stream4
is enabled Snort core dumps with a Signal 11. I originally thought it
was the cache_clean_percent bug we found but it seems even after
removing that value, snort still core dumps.

If stream4 is disabled, Snort doesn't core and runs fine.

Is stream4 not able to handle HDLC frames?

Here is the entire line:

preprocessor stream4: disable_evasion_alerts, timeout 60, memcap
204800000, cache_clean_sessions 5, self_preservation_threshold 3000,
self_preservation_period 60, suspend_threshold 6000, suspend_period 15,
suspend_period 15, max_sessions 65000




- --

Best Regards,

Eric Hines, GCIA, CISSP
CEO, President
Applied Watch Technologies, LLC
1095 Pingree Road
Suite 221
Crystal Lake, IL 60014
Toll Free: (877) 262-7593
Fax: (847) 854-5106
Cell: (847) 456-6785
Web: www.appliedwatch.com

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFFfc5J1va6QYTV0EMRAifiAJ9osxLptNnbQxigrV4JMugd/uAe5wCeOoLZ
BJ1iTLyW78a2t8Cxn/SINb0=
=Xd+c
-----END PGP SIGNATURE-----

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users