[Snort-devel] snort 1.8.2 crash

Michael Anderson mca at ...498...
Tue Nov 13 10:22:02 EST 2001


I have been running snort 1.8.2 for a week now and it crashed this
morning.  The backtrace looks like this:
(gdb) bt
#0  0x08052871 in mSearch (buf=0x40231078 'ÿ' <repeats 200 times>...,
blen=65535, ptrn=0x87e8760 "User-Agent:ICQ",
    plen=14, skip=0x87e8778, shift=0x87e8b80) at mstring.c:486
#1  0x08058c0b in CheckANDPatternMatch (p=0xbffff360, otn_idx=0x87e7e58,
fp_list=0x87e8bc0) at sp_pattern_match.c:781
#2  0x080590c5 in CheckTcpFlags (p=0xbffff360, otn_idx=0x87e7e58,
fp_list=0x87e8700) at sp_tcp_flag_check.c:238
#3  0x080562ab in EvalOpts (List=0x87e7e58, p=0xbffff360) at
rules.c:4137
#4  0x08055ff6 in EvalHeader (rtn_idx=0x80ec1c8, p=0xbffff360) at
rules.c:3850
#5  0x08055f84 in EvalPacket (List=0x809f378, mode=2, p=0xbffff360) at
rules.c:3778
#6  0x08055e00 in Detect (p=0xbffff360) at rules.c:3671
#7  0x08055c1b in Preprocess (p=0xbffff360) at rules.c:3514
#8  0x0804ae17 in ProcessPacket (user=0x0, pkthdr=0xbffff840,
pkt=0x40231042 "") at snort.c:545
#9  0x08077626 in packet_ring_recv ()
#10 0x0807794f in pcap_read ()
#11 0x080785ff in pcap_loop ()
#12 0x0804c2a3 in InterfaceThread (arg=0x0) at snort.c:1593
#13 0x0804ace9 in main (argc=8, argv=0xbffffa9c) at snort.c:478
#14 0x400bc177 in __libc_start_main (main=0x804a620 <main>, argc=8,
ubp_av=0xbffffa9c, init=0x8049cc4 <_init>,
    fini=0x8081ff0 <_fini>, rtld_fini=0x4000e184 <_dl_fini>,
stack_end=0xbffffa8c) at ../sysdeps/generic/libc-start.c:129

I am running on a dual 1.26GHz machine with Red Hat Linux 7.1.  Any
ideas about what might be going on.

-Mike





More information about the Snort-devel mailing list