[Snort-devel] Snort 2.0 Segmentation Fault

Juan Manzano manzano_juan at ...445...
Fri Apr 25 08:48:28 EDT 2003


Hi Chris,

Thank you very much for your help. Here is the BUGS forms filled:

System Architecture:
Alpha EV56 (AlphaServer 4100, 2 CPUs)

Operating System and version:
RedHat Linux 7.2 for Alpha (Kernel 2.4.9-32.5smp)

Version of Snort:
Snort-2.0.0

Preprocessors loaded:
None. After the first time the error appeared, I tried to isolate the 
problem, commenting one by one all the preprocessors. Now, there is none 
loaded.

Rules used:
	include $RULE_PATH/web-cgi.rules
	include $RULE_PATH/web-coldfusion.rules
	include $RULE_PATH/web-iis.rules
	include $RULE_PATH/web-frontpage.rules
	include $RULE_PATH/web-misc.rules
	include $RULE_PATH/web-client.rules
	include $RULE_PATH/web-php.rules

Output plug-ins you loaded:
Initially
	output database: log, mysql
after the error, I changed it to
	output alert_csv: ./snort.csv msg,proto,timestamp,src,srcport,dst,dstport

Command line switches used:
-i eth1 -l /root/snort2/ -c /root/snort2/etc/snortconf.conf dst net 
10.1.249.128 mask 255.255.255.224 and
not host 10.1.249.129

Snort error messages displayed:
10681 Segmentation fault      /root/snort2/snort -i eth1 -l /root/snort2/ -c 
/root/snort2/etc/snortconf.conf dst net 10.1.249.128 mask 255.255.255.224 
and not host 10.1.249.129

Core Dumped: No. Also, I builded a debugging-enabled snort but the error 
still appears, its message stays the same and there is no core dumped.

Again thanks,

Juan



>From: Chris Green <cmg at ...402...>
>Reply-To: snort-devel at lists.sourceforge.net
>To: "Juan Manzano" <manzano_juan at ...445...>
>CC: snort-devel at lists.sourceforge.net
>Subject: Re: [Snort-devel] Snort 2.0 Segmentation Fault
>Date: Thu, 24 Apr 2003 08:29:43 -0400
>
>"Juan Manzano" <manzano_juan at ...445...> writes:
>
> > 1.  (*) text/plain ( ) text/html
> >
> > Hi all,
> >
> > I have been experiencing a Segmentation Fault error with Snort
> > 2.0. The error seems to happen when some rule is triggered and Snort
> > tries to record the event in the defined output plugin. Also, I tried
> > using various output plugins like mysql and csv, but there was no
> > change. If I comment all rules in the snort.conf file, the error
> > doesn't appear. My Snort is running on a AlphaServer 4100, Red Hat
> > Linux 7.2 for Alpha, Kernel 2.4.9-32.5smp. I'll appreciate very much
> > if you can help me in this matter.
>
>This is probably an alignment error.
>
>Please see the doc/BUGS file and send this mailing list a
>backtrace. Thanks!
>
>
> >
> > Thanks,
> >
> > Juan
>
>--
>Chris Green <cmg at ...402...>
>"Yeah, but you're taking the universe out of context."


_________________________________________________________________
MSN 8 with e-mail virus protection service: 2 months FREE* 
http://join.msn.com/?page=features/virus





More information about the Snort-devel mailing list