[Snort-devel] Bus error w/ Snort 2.0
paul at ...2079...
Fri Jul 18 05:39:02 EDT 2003
Thanks for the reply. I ran into time constraints and had to try Solaris 8.
I loaded it on an identical system, compiled Snort 2.0.0 w/ gcc 3.3 and set
it up the same as before. It ran without problems so I went that route for
all the sensors.
I'm setting up a Solaris 9 system in my office and if I can get it to fail
as before, I will try your suggestions below and report the findings.
I did notice when doing various backtraces of core files that they all
seemed to happen while processing HTTP/CGI traffic.
Erek Adams wrote:
> On Sat, 12 Jul 2003, Paul Whittenburg wrote:
>>I'm setting up a few sensors and am having a problem where Snort core dumps
>>after running for a while. Here are the specifics of my environment:
>>Solaris 9 4/03 with the latest recommended patches installed on a Sun Netra
>>T1 (Sparc). I compiled Snort 2.0.0 w/ gcc 3.3 and updated the rules. My
>>snort.conf is pretty standard - I'm not trying anything tricky. I'm listening
>>on a stealth interface (hme0).
> Odd. I'm running Snort on a Solaris 9 (fully updated and patched) box and
> it's chugging away happily.
> One thing that you might want to try is to downgrade gcc to 2.95 and see
> if you still get the error. I've heard of some issues with gcc 3.x, but I
> thought they had all be resolved.
> And just to be safe, see if you can get a pcap (65535 snaplen) of the
> data. It'll be interesting to see if it's the packet or if it's something
> Erek Adams
> "When things get weird, the weird turn pro." H.S. Thompson
<paul at ...2079...>
More information about the Snort-devel