[Snort-devel] Bug in 1.8.1 running on AXP RH 7.1

Mark Novak mnovak at ...815...
Tue Sep 11 14:32:04 EDT 2001


Hi all,

I am getting an unaligned trap error where Snort stops running.  This 
occurs every sporadically throughout the course of a 24 hour period.  I 
read and followed the instructions in the BUGS file, hopefully this is 
everything you need.

RedHat 7.1 on an Alpha AXP (AlphaServer 800 5/333) with 128MB RAM, DE500 
NIC (with no ip address 'ipconfig eth0 up')

Using the default ruleset provided in snort.conf.

# snort -d -h xxx.xx.xxx.xx/29 -l /var/log/snort -c snort.conf -i eth0



<gdb>
Core was generated by 'snort -d -h xxx.xx.xxx.xx/29 -l /var/log/snort -c 
snort.conf -i eth0'
Program terminated with signal 11, Segmentation fault.
Reading symbols from /lib/libm.so.6.1...done
Loaded symbols for /lib/libm.so.6.1
Reading symbols from /lib/libnsl.so.1.1...done
Loaded symbols for /lib/libnsl.so.1.1
Reading symbols from /lib/libssl.so.1
Loaded symbols for /lib/libssl.so.1
Reading symbols from /lib/libcrypto.so.1
Loaded symbols for /lib/libcrypto.so.1
Reading symbols from /lib/libc.so.6.1
Loaded symbols for /lib/libc.so.6.1
Reading symbols from /lib/ld-linux.so.2
Loaded symbols for /lib/ld-linux.so.2
Reading symbols from /lib/libnss_files.so.2
Loaded symbols for /lib/libnss_files.so.2
Reading symbols from /lib/libnss_nisplus.so.2
Loaded symbols for /lib/libnss_nisplus.so.2
#0 0x12004b220 in SubSlide (P=0x402207a34821f621, whichway=0)
at ubi_BinTree.c:394
394 while( NULL != P->Link[ whichway ] )

<bt>
#0 0x12004b220 in SubSlide (p=0x402207a34821f621, whichway=0) at 
ubi_BinTree.c:394
#1 0x120051638 in PruneSessionCache (thetime=1000240508, mustdie=537186304) 
at spp_stream4.c:2414
#2 0x12004f2a0 in ReassembleStream4 (p=0x11ffff080) at spp_stream4.c:1272
#3 0x120017024 in Preprocess (p=0x11ffff080) at rules.c:3426
#4 0x120004a40 in ProcessPacket (user=0x402207a34821f621 <Address 
0x402207a34821f621 out of bounds>,
     pkthdr=0x0, pkt=0x0) at snort.c:534
#5 0x120055140 in packet_ring_recv (p=0x1200c88c0, cnt=2147483647, 
callback=0x120004880 <ProcessPacket>,
     user=0x0) at ./pcap-linux.c:254
#6 0x1200555b0 in pcap_read (p=0x1200c88c0, cnt=2147483647, 
callback=0x120004880 <ProcessPacket>,
     user=0x0) at ./pcap-linux.c:345
#7 0x120056858 in pcap_loop (p=0x1200c88c0, cnt=-1, callback=0x120004880 
<ProcessPacket>,
     user=0x0) at ./pcap.c:76
#8 0x1200066c4 in InterfaceThread (arg=0x402207a34821f621) at snort.c:1561
#9 0x120004848 in main (argc=10, argv=0x1200925c0) at snort.c:467
#10 0x200002ba7dc in __libc_start_main (main=0x120003f20 <main>, argc=10,
       ubp_av=0x11ffff9d8, init=0x120003d90 <_init>, fini=0x2000002c798 
<_dl_debug_mask>,
       rtld_fini=0x625, stack_end=0x11ffff9c0) at 
../sysdeps/generic/libc-start.c:129





More information about the Snort-devel mailing list