[Snort-users] Snort with snortsam on 64bit segfault

Frank Knobbe frank at ...9761...
Sat Aug 29 16:59:16 EDT 2009

On Wed, 2009-08-26 at 11:24 -0400, Gary Pitman wrote:
> I have Snort running on RHEL5 64bit and after patching for snortsam  it 
> will only run for about 5-10 seconds before getting a segfault. The 
> strange thing is that I have had the problem of Snort not being able to 
> start when adding the "output fwsam" line previously because the patch 
> was not used correctly, but now it does start but then dies.
> I do see that the patch added the 3 spo_alert_fwsam.* files in the 
> src/output-plugins directory so I am assuming the patch ran correctly. I 
> am wondering if the patch is not 64bit friendly. Has anyone had success 
> with this version on x64?

Yeah, as Luis mentioned, your Snortsam patch probably doesn't have the
TwoFish routines that work on 64 bit.

The Snortsam patch to Snort will have created the files twofish.c and
twofish.h in the /src dir. Replace these with
http://www.knobbe.us/twofish.c and twofish.h.

It appears that the Snortsam web site over at Emerging Threats hasn't
been update well, so I'll take the project incl web site over again
soon. Can't promise lots of support, but at least the files will all be
current and available then.


It is said that the Internet is a public utility. As such, it is best
compared to a sewer. A big, fat pipe with a bunch of crap sloshing
against your ports.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 188 bytes
Desc: This is a digitally signed message part
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20090829/f0c5f14f/attachment.sig>

More information about the Snort-users mailing list