[Snort-devel] [Fwd: Re: [Snort-users] Bus error on sparc]

Michael Bell michael.bell at ...1979...
Wed May 14 08:11:12 EDT 2003


Due to an advice from Erek Adams I forward three mails from snort-users.

Michael

-------- Original Message --------
Subject: Re: [Snort-users] Bus error on sparc
Date: Wed, 14 May 2003 11:27:50 +0200
From: Michael Bell <michael.bell at ...1979...>
To: snort-users at lists.sourceforge.net
References: <3EC08C65.40009 at ...1979...> 
<3EC0FD2A.1000008 at ...1979...>

Hi all,

I debug a little bit with gdb and see that snort always crashs with
activated stream4 in decode.c at DecodeUDP line 2329.

This is the first time where the function accesses the ip header
(p->iph->...). The surprising thing is that this code only crashs with
activated stream4 but stream4 should never access a package which is not
tcp. So has somebody an idea why stream4 does anything with a udp packet?

I find a function NotForStream4 which checks for an existent tcp header.
Is it possible that this header is not NULL even if it is a udp packet?

Greetings Michael

P.S. should I ask such questions on snort-devel?
-- 
-------------------------------------------------------------------
Michael Bell                   Email: michael.bell at ...1979...
ZE Computer- und Medienservice            Tel.: +49 (0)30-2093 2482
(Computing Centre)                        Fax:  +49 (0)30-2093 2704
Humboldt-University of Berlin
Unter den Linden 6
10099 Berlin                   Email (private): michael.bell at ...1980...
Germany                                       http://www.openca.org



-------------------------------------------------------
Enterprise Linux Forum Conference & Expo, June 4-6, 2003, Santa Clara
The only event dedicated to issues related to Linux enterprise solutions
www.enterpriselinuxforum.com

_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


-- 
-------------------------------------------------------------------
Michael Bell                   Email: michael.bell at ...1979...
ZE Computer- und Medienservice            Tel.: +49 (0)30-2093 2482
(Computing Centre)                        Fax:  +49 (0)30-2093 2704
Humboldt-University of Berlin
Unter den Linden 6
10099 Berlin                   Email (private): michael.bell at ...1980...
Germany                                       http://www.openca.org





More information about the Snort-devel mailing list