[Snort-devel] Windows Server 2008 Standard x86 and sensitive-data.rules crashing

Michael Steele michaels at ...2826...
Sun Apr 24 21:39:34 EDT 2011


Steven,

Snort_2_9_0_4_Installer.exe
MD5: 00BB70B331CA89F535B15C6260A0719C

WinPcap_4_1_2.exe
MD5: 929B7D846B635959201E30B57190284A


Kindest regards,
Michael...

WINSNORT.com Management Team Member


-----Original Message-----
From: Steven Sturges [mailto:ssturges at ...402...] 
Sent: Sunday, April 24, 2011 9:04 PM
To: Michael Steele
Cc: snort-devel at lists.sourceforge.net
Subject: Re: [Snort-devel] Windows Server 2008 Standard x86 and
sensitive-data.rules crashing

Hi Michael--

What is your specific Snort version (md5sum of Snort Installer)... what
version of Winpcap?

Thanks
-steve

On 4/24/11 9:10 AM, Michael Steele wrote:
> We are moving a single sensor to Server 2008 Standard x86 (SP2) for 
> testing, and have installed all the latest stable releases of Snort and
the rules.
>
> When Snort is ran in test mode (-T), Snort crashes.
>
> Problem signature:
>    Problem Event Name:	APPCRASH
>    Application Name:	snort.exe
>    Application Version:	0.0.0.0
>    Application Timestamp:	4d6bee97
>    Fault Module Name:	ntdll.dll
>    Fault Module Version:	6.0.6002.18327
>    Fault Module Timestamp:	4cb73436
>    Exception Code:	c0000005
>    Exception Offset:	000673dd
>    OS Version:	6.0.6002.2.2.0.272.7
>    Locale ID:	1033
>    Additional Information 1:	e0db
>    Additional Information 2:	e7f302e56a308d08c2241ce00f9533a4
>    Additional Information 3:	76e5
>    Additional Information 4:	433447cb6324885dd898e259eeaa4d08
>
> Going into the sensitive-data.rules file, all the rules must be 
> disabled before Snort will run.
>
> This is not happening with Server 2003, or XP with the exact same 
> configuration.
>
> Any help will be greatly appreciated, possibly a bug?
>
> Kindest regards,
> Michael...
>
> WINSNORT.com Management Team Member
>
>
> ----------------------------------------------------------------------
> --------
> Fulfilling the Lean Software Promise
> Lean software platforms are now widely adopted and the benefits have 
> been demonstrated beyond question. Learn why your peers are replacing 
> JEE containers with lightweight application servers - and what you can 
> gain from the move. http://p.sf.net/sfu/vmware-sfemails
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-devel
>





More information about the Snort-devel mailing list