[Snort-devel] Possible alignment issues with snort 2.1.0 on sparc?

Kurt Raschke kurt at ...2295...
Thu Dec 25 17:42:02 EST 2003

I'm running snort 2.1.0 on a Sun Ultra 5, and under both Debian Linux
and OpenBSD 3.4, snort fails right after initialization with a bus
error.  Based on the research I've done, the most likely cause is some
sort of alignment issue involving pcap.

Here's the relevant output from gdb:

-*> Snort! <*-
Version 2.1.0 (Build 11)
By Martin Roesch (roesch at ...402..., www.snort.org)

Program received signal SIGBUS, Bus error.
0x00017e40 in DecodeTCP (pkt=0x1f3f32 "", len=1480, p=0xeffff6a8)
    at decode.c:2221
2221            ph.sip = (u_int32_t)(p->iph->ip_src.s_addr);
(gdb) where
#0  0x00017e40 in DecodeTCP (pkt=0x1f3f32 "", len=1480, p=0xeffff6a8)
    at decode.c:2221
#1  0x00017444 in DecodeIP (pkt=0x1f3f1e "E", len=1500, p=0xeffff6a8)
    at decode.c:1937
#2  0x00012ae4 in DecodeEthPkt (p=0xeffff6a8, pkthdr=0xeffffa68, 
    pkt=0x1f3f10 "") at decode.c:114
#3  0x00030240 in ProcessPacket (user=0x0, pkthdr=0xeffffa68,
pkt=0x1f3f10 "")
    at snort.c:592
#4  0x7004b8a0 in pcap_read () from /usr/lib/libpcap.so.0
#5  0x7004b644 in pcap_read () from /usr/lib/libpcap.so.0
#6  0x7004c8cc in pcap_loop () from /usr/lib/libpcap.so.0
#7  0x00032618 in InterfaceThread (arg=0x0) at snort.c:1577
#8  0x000301b8 in SnortMain (argc=4, argv=0xeffffe14) at snort.c:559
#9  0x0002f5e8 in main (argc=4, argv=0xeffffe14) at snort.c:167

-Kurt Raschke

More information about the Snort-devel mailing list