[Snort-users] unaligned trap's on alpha system

Christopher C. Northrop chris.northrop at ...406...
Tue Nov 20 04:58:03 EST 2001


Hi Marty,

You may not believe this but I have been actually trying to get you guys an
Alpha system. When one is finally freed up, your on top of the list as
possible recipients. Sorry but I can't make any guaranties.

Other then the console messages snort seems to be still logging alerts, so
for know I'll just turn off the monitor.

Chris N.





-----Original Message-----
From: roesch at ...2250... [mailto:roesch at ...2250...]On
Behalf Of Martin Roesch
Sent: Monday, November 19, 2001 9:24 PM
To: Christopher C. Northrop
Cc: 'Snort user List'
Subject: Re: [Snort-users] unaligned trap's on alpha system


Hi Chris,
     I'm sorry to hear of your troubles, it's really hard for me to test
on RH/Alpha.  I've heard this problem before and unfortunately I don't
know a solution at this time.  I've got an alpha box running Tru64, but
none running Linux.

Got a loaner I could use? :)

     -Marty


"Christopher C. Northrop" wrote:
>
> Group,
>
> I'm getting unaligned trap's on an Aplpha system.
>
> What other information should I include?
>
> version 1.8.2
> kernel 2.4.14
> RH 7.1 libs
>
> w/ --enable-debug and I got this with every unaligned trap.
> 0   0
> 0   FF
> 0   0
> 0   0
> 0   FF
>
> I assume this this just means checking next rule?
>
> [*] Rule Head 265
> CheckDstIPEqual:   Mismatch on DIP
>    => Header check failed, checking next node
>
> error log:
> kernel: snort(18411): unaligned trap at 0000000120016f00: 00000001200be06a
> 28 2
> kernel: snort(18411): unaligned trap at 0000000120016f48: 00000001200be06e
> 28 2
> kernel: snort(18411): unaligned trap at 0000000120016f00: 00000001200be06a
> 28 2
> kernel: snort(18411): unaligned trap at 0000000120048b10: 00000001200be06e
> 28 2
> kernel: snort(18411): unaligned trap at 0000000120048b14: 00000001200be06a
> 28 1
>
> If there is no fix can someone tell me how to stop console logs.. Already
> removed from syslog.conf.
>
> Chris N.
>
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

--
Martin Roesch - President, Sourcefire Inc. - (410)552-6999
roesch at ...1935... - http://www.sourcefire.com
Snort: Open Source Network IDS - http://www.snort.org





More information about the Snort-users mailing list