[Snort-devel] Snort exited on signal 6

Russ Combs rcombs at ...402...
Sat Sep 28 05:31:55 EDT 2013


Michael,

I think I've figured out what's going on.  Can you check your config and
let me know if you have paf_max configured?

The line in the conf would be something like this:

config paf_max: 16000

If that is not configured, or if it is set to zero can you try testing with
it set to 16000?  That should circumvent the problem.

Thanks
Russ



On Mon, Sep 16, 2013 at 5:11 PM, Russ Combs <rcombs at ...402...> wrote:

> Thanks for reporting the problem.  Are you able to reproduce it?  If so,
> can you run in a debugger and get a backtrace?  A pcap and conf that
> triggers it would be most helpful.
>
> Thanks
> Russ
>
>
>
> On Wed, Sep 11, 2013 at 11:11 AM, Michael M Galapchuk <
> Michael.Galapchuk at ...3433...> wrote:
>
>> Hi everyone,
>>
>> in my new setup Snort exited on signal 6 shortly after start
>>
>> Sep 11 17:26:41 snort kernel: pid 1663 (snort), uid 40000: exited on
>> signal 6
>>
>> Here is some information in /tmp/snort.debug:
>>
>> Assertion failed: (b < HTTP_BUFFER_MAX && buf), function
>> SetHttpBufferEncoding, file ../../src/detection_util.h, line 142.
>>
>>
>> snort -V
>>
>> Version 2.9.5.3 GRE (Build 132) FreeBSD
>> By Martin Roesch & The Snort Team: http://www.snort.org/snort/snort-team
>> Copyright (C) 1998-2013 Sourcefire, Inc., et al.
>> Using libpcap version 1.4.0
>> Using PCRE version: 8.33 2013-05-28
>> Using ZLIB version: 1.2.7
>>
>> Should I provide some additional info?
>>
>> Mike.
>>
>>
>>
>>
>> ------------------------------------------------------------------------------
>> How ServiceNow helps IT people transform IT departments:
>> 1. Consolidate legacy IT systems to a single system of record for IT
>> 2. Standardize and globalize service processes across IT
>> 3. Implement zero-touch automation to replace manual, redundant tasks
>>
>> http://pubads.g.doubleclick.net/gampad/clk?id=51271111&iu=/4140/ostg.clktrk
>> _______________________________________________
>> Snort-devel mailing list
>> Snort-devel at lists.sourceforge.net
>> https://lists.sourceforge.net/lists/listinfo/snort-devel
>> Archive:
>> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel
>>
>> Please visit http://blog.snort.org for the latest news about Snort!
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20130928/1cc5f501/attachment.html>


More information about the Snort-devel mailing list