[Snort-users] Question involving segmentation fault

Chip Kelly Chip.Kelly at ...4824...
Wed Feb 6 10:05:13 EST 2002

FWIW, I've experienced the same behavior, running 1.8.3 on RH7.1, using libpcap 0.6.2. It doesn't happen every time I stop snort with the kill command, but on a high percentage of the times that I actually stop the process. Now that I have been enlightened with the kill -HUP signal to cause snort to pause and pick up rule modifications, I tend to leave snort running for much longer periods of time. -chip

-----Original Message-----
From: Phil Wood [mailto:cpw at ...440...]
Sent: Wednesday, February 06, 2002 12:08 PM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] Question involving segmentation fault


I've got a re-occuring problem to do with signal handling in snort.
It has happened at one time or another with ever version up to the current
(1.8.4-beta1).  And that is, sometimes when I send a TERM signal to
the snort process, it will segmentation fault.  This doesn't occur always,
but usually after a realtively long run (24 hours).  I restart the
snort process every 24 hours by issuing the kill command.  The process
is encapsulated in a shell script which packages up the results, moves
any core files to a unique name, and restarts the snort process. 

I even tried using the tcpdump signal handling stuff to see if it might
be some bollixed up linux libc library problem. However, nothing I've done
has made any difference.  It happens on redhat? and debian potato linux 
systems.  It could be some problem I've introduced through my own munging.
But, I just thought I'd ask and see if anyone else is seeing this problem.



Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

More information about the Snort-users mailing list