[Snort-users] Segment Fault Error in snort-2.9.4.5

Ashraf Ali ashrafali.ibs at ...11827...
Sun Apr 21 03:12:24 EDT 2013


Yes , snort is still running , and Baryard2 is stopped.
what i have observed is the sig id :1384 is repeated in community rules
also, so i have disabled it in snort rules by adding # in front .

is it because of duplicate rules in snort.rules and in community.rules ?

Ashraf



On Fri, Apr 19, 2013 at 7:52 PM, Joel Esler <jesler at ...1935...> wrote:

>
> On Apr 19, 2013, at 9:21 AM, Ashraf Ali <ashrafali.ibs at ...11827...> wrote:
>
> Hi All,
>
> i have recently install snort 2.9.4.5, with rules from snort and ET . i
> have  updated the sid-msg.map , classification.config , and
> reference.config files before starting the deamons of snort and barnyard2.
>
> everything was working fine in the past 2 days, but today , i have seen
> barnyard2 Deamon is not running, and in the logs i found this
>
> *
> Opened spool file '/var/log/snort/snort.u2.136637438'
> 04/19-18:07:13.315134  [**] [1:1384:15] DOS UPnP malformed advertisement
> [**]
> Segmentation fault*
>
> Does it mean that rule (sid 1384 ) is not in proper format or not correct ?
>
>
>
> Is Snort running?  Just Barnyard2 stopped?
>
> Joel
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20130421/da3e2226/attachment.html>


More information about the Snort-users mailing list