[Snort-users] Re: snort crash ...

Dragos Ruiu dr at ...50...
Wed Aug 2 19:49:21 EDT 2000

On Wed, 02 Aug 2000, Fyodor wrote:
> ~ :Just some information,
> ~ :Snort crashes when using the spp_defrag that comes with snort-1.6.3 (just
> ~ :like reported by Fabio) but with spp_defrag beta17 it does not crash
> ~ :anymore. Well, not for me anyway. 
> ~ :I'm currently using snort 1.6.3 with Martin's #ifdef patch and spp_defrag
> ~ :beta17 and I've been flooding it serveral hours with all kinds of strange
> ~ :packets and it seems uncrashable, even when using the defrag preprocessor.
>  Seems that Dragos' recent improvements fixed the problem then. Thanks for
> your feedback :-)

When I was debugging this last issue, I spent a lot of time single-stepping
through the code with a debugger. It turned out not to help me with chasing
down this last problem, which was caught by comparing the differences
in operation between two boxes Linux and FreeBSD operating on the
same traffic and checking how they behave differently, but it did let
me get a good feel for the operations of the code and I'm pretty confident
of its correct operation currently....

Now for that Beta18 release that tries to fix the Solaris/SunOS probs....
And I might just even stop calling it beta.


dursec.com ltd. / kyx.net - we're from the future    http://www.dursec.com

More information about the Snort-users mailing list