[Snort-devel] FreeBSD 4.4. - snort exited on signal 11

Dmitry Dolzenko dol at ...870...
Mon Oct 8 09:17:07 EDT 2001


Dear Developers,

I have faced with a strange problem.
When I run snort with command line
> snort -A fast -N -c snort.conf -i de0 -p
snort work fine about 12-20 hours, and exit with core dump
> Oct  8 05:35:53 mig /kernel: pid 11916 (snort), uid 0: exited on signal 11 (core dumped)

Host - PII-350/256 ram with DEC21041 chip NIC (de0) and Intel
EtherExpress 100 NIC (fxp0).

OS - FreeBSD 4.4
#uname -a FreeBSD
mig.phys.msu.su 4.4-STABLE FreeBSD 4.4-STABLE #0: Fri Oct 5 21:20:52
MSD 2001 root at ...871...:/usr/src/sys/compile/MIG i386

This is gdb output:
> [root at ...872...] 19:57 snort #gdb /usr/local/bin/snort snort.core
> GNU gdb 4.18
> Copyright 1998 Free Software Foundation, Inc.
> GDB is free software, covered by the GNU General Public License, and you are
> welcome to change it and/or distribute copies of it under certain conditions.
> Type "show copying" to see the conditions.
> There is absolutely no warranty for GDB.  Type "show warranty" for details.
> This GDB was configured as "i386-unknown-freebsd"...(no debugging symbols found)...
> Core was generated by `snort'.
> Program terminated with signal 11, Segmentation fault.
> Reading symbols from /usr/lib/libpcap.so.2...(no debugging symbols found)...done.
> Reading symbols from /usr/lib/libm.so.2...(no debugging symbols found)...done.
> Reading symbols from /usr/lib/libssl.so.2...(no debugging symbols found)...done.
> Reading symbols from /usr/lib/libcrypto.so.2...(no debugging symbols found)...done.
> Reading symbols from /usr/lib/libc.so.4...(no debugging symbols found)...done.
> Reading symbols from /usr/libexec/ld-elf.so.1...(no debugging symbols found)...done.
> #0  0x8074932 in strlcat ()
> (gdb) bt
> #0  0x8074932 in strlcat ()
> #1  0x8074979 in strlcat ()
> #2  0x8074d17 in strlcat ()
> #3  0x8078567 in strlcat ()
> #4  0x8076e8c in strlcat ()
> #5  0x805656f in sigprocmask ()
> #6  0x804b21f in sigprocmask ()
> #7  0x280b76b9 in pcap_read () from /usr/lib/libpcap.so.2
> #8  0x280b732f in pcap_loop () from /usr/lib/libpcap.so.2
> #9  0x804c750 in sigprocmask ()
> #10 0x804b0e0 in sigprocmask ()
> #11 0x804a9a9 in sigprocmask ()
> (gdb) quit

snort.conf attached.

Thank you in advance!

Best Regards,
 Dmitry Dolzenko, LAN admin.





More information about the Snort-devel mailing list