[Snort-devel] 1.9.0 segfault on Alpha

Kunos Péter Kunos.Peter at ...1614...
Thu Oct 10 08:11:03 EDT 2002


I tried to get an answer on the users mailing list, without success.
In a nutshell: i think i have found a bug.

I used Snort 1.8 for a while on my DEC Alphaserver 1200 with

My latest working configuration was Snort 1.8.7 with Debian 3.0, all stable updates,
Mysql Ver 11.16 Distrib 3.23.49

	Version of Snort


	OS and Version

Linux, Debian 3.0, kernel 2.4.18 pcap 6.2
Machine: Alphaserver 1200, DEC Alpha ev56

	How do you start it?

snort -i <eth iface> -vde -l /<logfile path>

Yes, just for testing.

	How do you know it was Snort that caused it (snort) to exit?

How can i tell that it wasn't? :)
I started it in console mode (not daemon).

	What's the segfault msg?  ('gdb snort core' and then 'bt' would be
helpful--More info in the BUGS file in the tarball.)

"Segmentation fault" Nothing more. It runs for a few seconds. No core dump. 
But some "[!] WARNING: IP Len field is 6 bytes smaller than captured length." messages are on the console, i think this must be a clue.

(And every version of snort produces "unaligned trap" kernel messages on this machine, but it's an other story)

Peter Kunos

More information about the Snort-devel mailing list