Re: Snort Processes randonly dies

[Avery Rozar <Avery.Rozar () i-techsupport com>]

Well, it happens in Daemon mode, but to see the error I have to run it in a terminal.

snort -I -i eth1 -u snort -g snort -c /etc/snort/snort.conf -l /var/log/snort

This is how it was compiled.

./configure --enable-64bit-gcc --enable-inline-init-failopen --enable-ipv6 --enable-mpls --enable-targetbased 
--enable-zlib --enable-active-response --enable-normalizer --enable-reload --enable-ppm --enable-debug  
--enable-dynamicplugin --enable-perfprofiling --enable-react --enable-flexresp3 --enable-gre --enable-sourcefire

Attached is the snort.conf file.

________________________________________
From: Hui Cao [hcao () sourcefire com]
Sent: Friday, March 01, 2013 2:41 PM
To: Avery Rozar
Cc: snort-users () lists sourceforge net
Subject: Re: [Snort-users] Snort Processes randonly dies

Can you provide the reproduction steps? What command and arguments you
used? What's the config file?

This issue indicates the buffer isn't sufficient to hold the
additional data or other errors. If you compiled snort without
enabling debug, you shouldn't have this error.

Best,
Hui.

On Fri, Mar 1, 2013 at 2:12 PM, Avery Rozar
<Avery.Rozar () i-techsupport com> wrote:
> Has anyone ran into this issue?
>
> The error I get on the terminal is
>
> snort: ../include/snort_bounds.h:98: SafeMemcpy: Assertion '0==1' failed
>
> Any the snort process dies. Using CentOS 6.3, and Snort 2.9.4.
>
>
> Thank you.
>
> ------------------------------------------------------------------------------
> Everyone hates slow websites. So do we.
> Make your web apps faster with AppDynamics
> Download AppDynamics Lite for free today:
> http://p.sf.net/sfu/appdyn_d2d_feb
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest Snort news!

Attachment: snort.txt
Description: snort.txt

------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_feb

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!