Re: Snort exited on signal 6

[Russ Combs <rcombs () sourcefire com>]

Michael,

I think I've figured out what's going on.  Can you check your config and
let me know if you have paf_max configured?

The line in the conf would be something like this:

config paf_max: 16000

If that is not configured, or if it is set to zero can you try testing with
it set to 16000?  That should circumvent the problem.

Thanks
Russ



On Mon, Sep 16, 2013 at 5:11 PM, Russ Combs <rcombs () sourcefire com> wrote:

> Thanks for reporting the problem.  Are you able to reproduce it?  If so,
> can you run in a debugger and get a backtrace?  A pcap and conf that
> triggers it would be most helpful.
>
> Thanks
> Russ
>
>
>
> On Wed, Sep 11, 2013 at 11:11 AM, Michael M Galapchuk <
> Michael.Galapchuk () fcbank com ua> wrote:
>
> > Hi everyone,
> >
> > in my new setup Snort exited on signal 6 shortly after start
> >
> > Sep 11 17:26:41 snort kernel: pid 1663 (snort), uid 40000: exited on
> > signal 6
> >
> > Here is some information in /tmp/snort.debug:
> >
> > Assertion failed: (b < HTTP_BUFFER_MAX && buf), function
> > SetHttpBufferEncoding, file ../../src/detection_util.h, line 142.
> >
> >
> > snort -V
> >
> > Version 2.9.5.3 GRE (Build 132) FreeBSD
> > By Martin Roesch & The Snort Team: http://www.snort.org/snort/snort-team
> > Copyright (C) 1998-2013 Sourcefire, Inc., et al.
> > Using libpcap version 1.4.0
> > Using PCRE version: 8.33 2013-05-28
> > Using ZLIB version: 1.2.7
> >
> > Should I provide some additional info?
> >
> > Mike.
> >
> >
> >
> >
> > ------------------------------------------------------------------------------
> > How ServiceNow helps IT people transform IT departments:
> > 1. Consolidate legacy IT systems to a single system of record for IT
> > 2. Standardize and globalize service processes across IT
> > 3. Implement zero-touch automation to replace manual, redundant tasks
> >
> > http://pubads.g.doubleclick.net/gampad/clk?id=51271111&iu=/4140/ostg.clktrk
> > _______________________________________________
> > Snort-devel mailing list
> > Snort-devel () lists sourceforge net
> > https://lists.sourceforge.net/lists/listinfo/snort-devel
> > Archive:
> > http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel
> >
> > Please visit http://blog.snort.org for the latest news about Snort!
------------------------------------------------------------------------------
October Webinars: Code for Performance
Free Intel webinars can help you accelerate application performance.
Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
the latest Intel processors and coprocessors. See abstracts and register >
http://pubads.g.doubleclick.net/gampad/clk?id=60133471&iu=/4140/ostg.clktrk

_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel
Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel

Please visit http://blog.snort.org for the latest news about Snort!