[Snort-users] Garbage Packet with Null Pointer discarded?

Dragos Ruiu dr at ...381...
Wed Sep 20 17:22:05 EDT 2000



Uhm... that would be my fault.

That message comes form the defragger plug in I wrote.
You must be using the 1.6.3 release..... and the defragger
is _broken_ in that version.

Two solutions are possible:

-turn off the defragger by removing the "preprocessor defrag"  line from your
  rules file

-Alternatively upgrade your defragger to the latest version. The file
  is  "spp_defrag.c"

Any version after and including Beta 17 of this file should work
unless you are using Solaris.  For the solaris crash bug with this
preprocessor, I just released a fix last night.  The snort-devel guys
seem to be trying it out with some success, so now I'll circulate it 
more widely in preparation for the general snort 1.7 (1.64?) release 
due soon. 

Anyway, if you replace your spp_defrag.c with the one attached
to this message it should eliminate your problems.  Similarly for Solaris
users, I _believe_ that this defragger is also fully functional.
If no-one complains, in a couple of days, I'll stop calling it beta
(famous last words :-).

cheers,
--dr

On Wed, 20 Sep 2000, Daniel Swan wrote:
> "Garbage Packet with Null Pointer discarded!"
> 
> I'm getting tons of these every minute in /var/log/messages.  Otherwise, snort seems to be working ok.
> 
> What are they?
> 
> Thanks in advance, 
> Dan.
> 
> 
> 
> 
> 
> --== Sent via Deja.com http://www.deja.com/ ==--
> Before you buy.
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> http://lists.sourceforge.net/mailman/listinfo/snort-users
-- 
Dragos Ruiu <dr at ...50...>   dursec.com ltd. / kyx.net - we're from the future 
gpg/pgp key on file at wwwkeys.pgp.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: spp_defrag.c
Type: text/english
Size: 18856 bytes
Desc: not available
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20000920/b4fb76d7/attachment.bin>


More information about the Snort-users mailing list