[Snort-devel] Re: beta 6 reports...

Erek Adams erek at ...105...
Thu Nov 30 11:36:04 EST 2000


On Wed, 29 Nov 2000, Martin Roesch wrote:

> Well, so far no one has reported any crashes or unexpected behavior with
> beta 6, could it possibly be stable? :)

It might be, but I'm not.   ;-)

I'm still getting some wierd errors on Solaris.

One thing I have found:  1.6.3 was/is able to see that you only have one
interface on a box and default to using it.  1.7b6 doesn't.  In fact, if you
don't specify it, it will cause the program to dump core on Solaris 2.7.  

---
Program terminated with signal 11, Segmentation Fault.
Reading symbols from /usr/lib/libsocket.so.1...done.
Reading symbols from /usr/lib/libnsl.so.1...done.
Reading symbols from /usr/lib/libc.so.1...done.
Reading symbols from /usr/lib/libdl.so.1...done.
Reading symbols from /usr/lib/libmp.so.2...done.
Reading symbols from /usr/lib/nss_files.so.1...done.
#0  0xef636dcc in strlen () from /usr/lib/libc.so.1
(gdb) bt
#0  0xef636dcc in strlen () from /usr/lib/libc.so.1
#1  0xef67fba0 in _doprnt () from /usr/lib/libc.so.1
#2  0xef681758 in printf () from /usr/lib/libc.so.1
#3  0x19fac in main (argc=10, argv=0xeffffbd4) at snort.c:205
---

Add it to the command line with '-i le0' and it's happier...  Almost...

----
Program terminated with signal 11, Segmentation Fault.
Reading symbols from /usr/lib/libsocket.so.1...done.
Reading symbols from /usr/lib/libnsl.so.1...done.
Reading symbols from /usr/lib/libc.so.1...done.
Reading symbols from /usr/lib/libdl.so.1...done.
Reading symbols from /usr/lib/libmp.so.2...done.
Reading symbols from /usr/lib/nss_files.so.1...done.
#0  ParseRuleOptions (rule=0x0, rule_type=1, protocol=6) at rules.c:1593
1593            free(toks[i]);
(gdb) bt
#0  ParseRuleOptions (rule=0x0, rule_type=1, protocol=6) at rules.c:1593
#1  0x22598 in ParseRule (
    prule=0xefffeda2 "pass tcp 205.164.217.39 80 <> any any", inclevel=1)
    at rules.c:554
#2  0x21e84 in ParseRulesFile (file=0x6c000 "", inclevel=1) at rules.c:144
#3  0x222bc in ParseRule (
    prule=0xeffff6d0 "include /local/snort/rapidnet.rules", inclevel=0)
    at rules.c:364
#4  0x21e84 in ParseRulesFile (file=0x6c000 "", inclevel=0) at rules.c:144
#5  0x1a09c in main (argc=12, argv=0xeffffbc4) at snort.c:256
----

I think I broke it...  :(

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net




More information about the Snort-devel mailing list