[Snort-devel] -*> Snort! <*- Version 1.8-beta5 (Build 24)

Phil Wood cpw at ...86...
Thu May 31 16:28:32 EDT 2001


Has anyone reported problems related to:

1. WARNING: rpc_decode calculated bad length: 1213486160 ('HTTP')

2. Bad icmp packets where the transport/data portion of the packet is
   actually data from snort (like a bunch of sql commands/data)

   (and evidence that there were no "bad" icmp packets provided by a
    parallel tcpdump (with appropirate bpf filter))

3. Segmentation faults where the stack is lost:

   # gdb xay20010531.0801 cay20010531.0801
   GNU gdb 19991004
   Copyright 1998 Free Software Foundation, Inc.
   GDB is free software, covered by the GNU General Public License, and you are
   welcome to change it and/or distribute copies of it under certain conditions.
   Type "show copying" to see the conditions.
   There is absolutely no warranty for GDB.  Type "show warranty" for details.
   This GDB was configured as "i386-redhat-linux"...
   
   warning: core file may not match specified executable file.
   Core was generated by `/data/pw-0.4-beta2/support/snort+/snort -i eth1 -L ay20010531.0801 '.
   Program terminated with signal 11, Segmentation fault.
   Cannot access memory at address 0x40013eb0
   #0  0x400c9004 in ?? ()Cannot access memory at address 0x40013eb0
   (gdb) where
   #0  0x400c9004 in ?? ()Cannot access memory at address 0x40013eb0
   (gdb) quit
   
Thanks,

Phil




More information about the Snort-devel mailing list