Snort mailing list archives

snort crash in DecodeTCP


From: hung quy <hung_quy () yahoo com>
Date: Tue, 19 Jan 2016 21:20:51 +0000 (UTC)

Hello,I am running snort version 2.9.7.2-4 on Ubuntu 12.04
I have a crash while running snort as follows:
(gdb) c
Continuing.

Program received signal SIGSEGV, Segmentation fault.
in_chksum_tcp6 (dlen=<optimized out>, d=0x7fa9dd221fea, ph=0x7ffffebc5ff0) at checksum.h:252
252     checksum.h: No such file or directory.
(gdb) bt
#0  in_chksum_tcp6 (dlen=<optimized out>, d=0x7fa9dd221fea, ph=0x7ffffebc5ff0) at checksum.h:252
#1  DecodeTCP (pkt=0x7fa9dd217036 "\333", <incomplete sequence \363>, len=46085, p=0xe8ac20) at decode.c:5320
#2  0x0000000000410cd9 in DecodeEthPkt (p=0xe8ac20, pkthdr=<optimized out>, pkt=0x7fa9dd217000 
"\304\064k\271\v\220\204\064\227\021\252Ć\335`") at decode.c:777
#3  0x0000000000430436 in ProcessPacket (p=0xe8ac20, pkthdr=<optimized out>, pkt=<optimized out>, ft=0x0) at 
snort.c:1849
#4  0x00000000004328e4 in PacketCallback (user=<optimized out>, pkthdr=0x7ffffebc60d0, pkt=0x7fa9dd217000 
"\304\064k\271\v\220\204\064\227\021\252Ć\335`") at snort.c:1717
#5  0x00000000004eb3b4 in pcap_process_loop ()
#6  0x00007fa9f42e4fa9 in ?? () from /opt/pkgs/dart/lib/libpcap.so.1
#7  0x00000000004eb54b in pcap_daq_acquire ()
#8  0x0000000000451123 in DAQ_Acquire (max=<optimized out>, callback=<optimized out>, user=<optimized out>) at 
sfdaq.c:541
#9  0x0000000000433b2c in PacketLoop () at snort.c:3268
#10 SnortMain (argc=14, argv=<optimized out>) at snort.c:920
#11 0x00007fa9f3af376d in __libc_start_main () from /lib/x86_64-linux-gnu/libc.so.6
#12 0x000000000040555d in _start ()

Any help on this issue is very appreciated.
Regards,Hung
------------------------------------------------------------------------------
Site24x7 APM Insight: Get Deep Visibility into Application Performance
APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
Monitor end-to-end web transactions and take corrective actions now
Troubleshoot faster and improve end-user experience. Signup Now!
http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Current thread: