[Snort-devel] Snort Not starting after latest cvs update

Len Burns lenb at ...122...
Sun Dec 3 12:58:09 EST 2000


On Sun, 3 Dec 2000, Martin Roesch wrote:

> Oops, I forgot to mention something: you don't need the square brackets on IP
> lists anymore.  Remove the bracket and try again...
Ok, done, and updated sources to the latest.  Now snort is dumping
core on start, no syslog message, only modification to the ruleset was
to remote the '[' ']' chars.  This is the backtrace:
(gdb) bt
#0  0x401a9d80 in malloc ()
#1  0xbfbfcf5c in ?? ()
#2  0x96fc in mSplit (
    str=0xbfbfcf37 "msg:\"MISC - Invalid PCAnywhere Login\"; content:
\"Invalid login\"; offset: 5; depth: 13;", sep=0xad6c ";",
max_strs=63, toks=0xbfbfce9c,
    meta=92 '\\') at mstring.c:152
#3  0xb024 in ParseRuleOptions (
    rule=0xbfbfcf18 "alert TCP any 5631 -> any any (msg:\"MISC -
Invalid PCAnywhere Login\"; content: \"Invalid login\"; offset: 5;
depth: 13;", rule_type=2,
    protocol=6) at rules.c:1473
#4  0xa459 in ParseRule (
    prule=0xbfbfd342 "alert TCP any 5631 -> any any (msg:\"MISC -
Invalid PCAnywhere Login\"; content: \"Invalid login\"; offset: 5;
depth: 13; )", inclevel=0)
    at rules.c:554
#5  0x9dfb in ParseRulesFile (file=0x2799c "snort.conf", inclevel=0)
    at rules.c:144
#6  0x1be0 in main (argc=8, argv=0xbfbfd794) at snort.c:256
(gdb)


-Len




More information about the Snort-devel mailing list