[Snort-users] Snort++ crashes abruptly

João Soares joaosoares11 at ...125...
Wed Dec 14 10:39:58 EST 2016


Thanks for your fast reply.

Is there any built-in option that does what you are asking? By stracing
snort I got these results:

... (thousands and thousands of nanosleeps)
nanosleep({0, 1000000}, NULL)           = 0
nanosleep({0, 1000000}, NULL)           = 0
nanosleep({0, 1000000}, NULL)           = 0
nanosleep({0, 1000000}, NULL)           = 0
nanosleep({0, 1000000}, NULL)           = 0
nanosleep({0, 1000000}, NULL)           = 0
nanosleep({0, 1000000},  <unfinished ...>
+++ killed by SIGABRT +++

Executing snort with -v, doesn't give me any more info other than what I
already provided:

snort:
/usr/local/src/snort3/src/service_inspectors/http_inspect/http_stream_splitter_reassemble.cc:208:
virtual const StreamBuffer* HttpStreamSplitter::reassemble(Flow*,
unsigned int, unsigned int, const uint8_t*, unsigned int, uint32_t,
unsigned int&): Assertion `total <= MAX_OCTETS' failed.
Aborted

On 12/14/2016 02:23 PM, Russ wrote:
> Ouch.  Thanks for reporting this.  Can you provide a full backtrace?
> 
> On 12/14/16 9:15 AM, João Soares wrote:
>> Hi everyone,
>>
>> I've just updated Snort++ to Version 3.0.0-a4 (Build 221) and it is
>> crashing from time to time. I've collected the following errors:
>>
>> AppIdDbg failed to create a related flow for xxx.xx.xx.xx-0 ->
>> yyy.yy.yy.yy-52094 17
>>
>> (The crash does not happen here)
>>
>> snort:
>> /usr/local/src/snort3/src/service_inspectors/http_inspect/http_stream_splitter_reassemble.cc:208:
>> virtual const StreamBuffer* HttpStreamSplitter::reassemble(Flow*,
>> unsigned int, unsigned int, const uint8_t*, unsigned int, uint32_t,
>> unsigned int&): Assertion `total <= MAX_OCTETS' failed.
>>
>> (It crashes here)
>>
>> Does anyone have any idea why this is happening? If you need additional
>> info, please reply, I will provide it ASAP.
>>
>> Best regards,
>> João Soares
>> ------------------------------------------------------------------------------
>> Check out the vibrant tech community on one of the world's most
>> engaging tech sites, SlashDot.org! http://sdm.link/slashdot
>> _______________________________________________
>> Snort-users mailing list
>> Snort-users at lists.sourceforge.net
>> Go to this URL to change user options or unsubscribe:
>> https://lists.sourceforge.net/lists/listinfo/snort-users
>> Snort-users list archive:
>> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>>
>> Please visit http://blog.snort.org to stay current on all the latest Snort news!
> 
> 
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most 
> engaging tech sites, SlashDot.org! http://sdm.link/slashdot
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
> 
> Please visit http://blog.snort.org to stay current on all the latest Snort news!
> 


More information about the Snort-users mailing list