[Snort-devel] Bus error w/ Snort 2.0

Erek Adams erek at ...835...
Tue Jul 15 12:29:31 EDT 2003


On Sat, 12 Jul 2003, Paul Whittenburg wrote:

> I'm setting up a few sensors and am having a problem where Snort core dumps
> after running for a while. Here are the specifics of my environment:
>
> Solaris 9 4/03 with the latest recommended patches installed on a Sun Netra
> T1 (Sparc). I compiled Snort 2.0.0 w/ gcc 3.3 and updated the rules. My
> snort.conf is pretty standard - I'm not trying anything tricky. I'm listening
> on a stealth interface (hme0).

[...snip....]

Odd.  I'm running Snort on a Solaris 9 (fully updated and patched) box and
it's chugging away happily.

One thing that you might want to try is to downgrade gcc to 2.95 and see
if you still get the error.  I've heard of some issues with gcc 3.x, but I
thought they had all be resolved.

And just to be safe, see if you can get a pcap (65535 snaplen) of the
data.  It'll be interesting to see if it's the packet or if it's something
else.

Cheers!

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson




More information about the Snort-devel mailing list