[Snort-users] Always die the same Snort instance

Jeronimo L. Cabral jelocabral at ...11827...
Mon Jun 11 09:05:38 EDT 2012


Dear, I have Snort 2.9.2.1 in a Debian Squeeze box with 2 GB RAM.

I have two instances: one in eth0 and the other in eth1, and always
Snort instance eth0 die after some hours.

I start both instances through /etc/rc.local, in the same way:

/usr/local/snort/bin/snort -D -u snort -g snort -c
/usr/local/snort/etc/snort-eth0.conf -i eth0

In oder to monitor the problem, I start this instance without daemon
mode, and I see:

 Preprocessor Object: SF_MODBUS (IPV6)  Version 1.1  <Build 1>
           Preprocessor Object: SF_FTPTELNET (IPV6)  Version 1.2  <Build 13>
           Preprocessor Object: SF_SIP (IPV6)  Version 1.1  <Build 1>
           Preprocessor Object: SF_SSH (IPV6)  Version 1.1  <Build 3>
           Preprocessor Object: SF_SMTP (IPV6)  Version 1.1  <Build 9>
Commencing packet processing (pid=3200)
..
...
....
Segmentation fault

I notice that I have a segmentation fault problem.

What can I do ???

Special thanks.

JeLo




More information about the Snort-users mailing list