[Snort-users] snort seg faults

Christopher E. Cramer chris.cramer at ...799...
Tue Jan 23 14:11:02 EST 2001


This was cleared up in a patch to the dynamic buffering in the stream
preprocessor.  In some odd cases, it seems that you _never_ got a
packet with the correct window size until it was time to read from the
buffer.  

The patched version is in the CVS and according to Erich Meier it seems to
clear up the segfaults.  For my own info, it would be nice to know if the
segfaults occured on heavily loaded networks.

Thanks
-Chris


On Tue, 23 Jan 2001, Bill Hutchison wrote:

> Jay,
> 
> 1.7 was core dumping for me daily until I turned off the stream preprocessor (I
> have the core's if anyone wants them).
> 
> It's been running over a week now without a problem.
> 
> This is on a OpenBSD 2.6 sparc system.
> 
> 
> -Bill
> 
> 
> "Austad, Jay" wrote:
> > 
> > Has anyone had trouble with snort segfaulting?  I'm running the 1.7 tarball
> > from the download page on snort.org.  It'll run for a day or two and then
> > seg fault.  I'm using -u to run as an unpriveledged user, so it doesn't seem
> > to be leaving a core file around.  I've removed -u and I'm waiting for it to
> > die again so I can get a core.
> > 
> > Jay
> > 
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users at lists.sourceforge.net
> > Go to this URL to change user options or unsubscribe:
> > http://lists.sourceforge.net/lists/listinfo/snort-users
> 
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> 






More information about the Snort-users mailing list