AW: [Snort-devel] snort 1.8.4 build 99 dumps core when using icmp pass rules with i type set

Poppi, Sandro Sandro.Poppi at ...1204...
Wed Mar 20 03:35:03 EST 2002

I found out the problem: I used ...;itype:5, icode:0;...
where I should have used semikolon instead of comma.

Now snort works. Maybe some additional syntax checking may help.

> "Poppi, Sandro" <Sandro.Poppi at ...1204...> writes:
> > Within the pass.rules file whenever there is a itype 
> defined it will core
> > dump. ICMP rules without the itype are parsed correctly.
> What does your itype option look like?
> itype; will cause snort to crash unfortunately instead of printing a
> warning. Noted and fixed.
> One problem with snort right now is that the same parsing bugs can
> appear in any plugin so we've got the distributed parser problem.
> That architecture problem is on the block to be fixed
> -- 
> Chris Green <cmg at ...402...>
> A watched process never cores.

More information about the Snort-devel mailing list