[Snort-users] "Incomplete Packet Fragments Discarded" crash

[Bill Hutchison]

Hello,

I've been running on snort 1.7 cvs (from 3/5/01, 3/16/01 ruleset) for some time
without problem.

This past weekend snort reported 78 "Incomplete Packet Fragments Discarded" and
then died.

Unfortunately there is no core file nor did snort's tcpdump logging save these
packets.  My tcpdump file from Snort is what I'm using to guess these packets
did kill snort, since the last packet in there is for the rule triggered a few
minutes before (a MISC traceroute).  There's nothing else in my system logs to
give a clue to what happened to snort...

Anyone else seen this?

I'm on OpenBSD 2.6 (sparc).



-Bill