Might this be a libnet issue?  Are you sure you are linking with the correct version for your platform?<br><br><div class="gmail_quote">On Wed, Apr 28, 2010 at 12:46 PM, Safwat Fahmy <span dir="ltr"><<a href="mailto:safwat.fahmy@...14822...">safwat.fahmy@...14822...</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">








<div link="blue" vlink="purple" lang="EN-US">

<div>

<p class="MsoNormal">Running snort 2.8.6 with the flowing command line:</p>

<p class="MsoNormal"> </p>

<p class="MsoNormal">/snort286inline/bin/snort -QDc
/mnt/smlog/snort286inline/etc/snort.conf -l /mnt/smlog/logs br0</p>

<p class="MsoNormal"> </p>

<p class="MsoNormal">Result in the following error:</p>

<p class="MsoNormal"> </p>

<p class="MsoNormal">initializing Inline mode</p>

<p class="MsoNormal">building cached socket reset packets</p>

<p class="MsoNormal">** glibc detected *** /mnt/smlog/snort286inline/bin/snort:
malloc(): memory corruption: 0x000000000143ece0 ***</p>

<p class="MsoNormal">====== Backtrace: =========</p>

<p class="MsoNormal"> </p>

<p class="MsoNormal"> </p>

<p class="MsoNormal">This is the config options:</p>

<p class="MsoNormal">re --enable-build-dynamic-examples --enable-ipv6
--enable-gre --enable-timestats --enable-perfprofiling --enable-inline
--enable-sourcefire --enable-aruba --enable-react --enable-flexresp2
--with-libpcap-libraries=/usr/lib64 --with-libpcre-libraries=/usr/lib64
--with-libipq-includes=/usr/include --with-libipq-libraries=/usr/lib
--with-libnet-includes=/usr/include --with-libnet-libraries=/usr/lib64
--with-dnet-libraries=/usr/lib64 --with-mysql=/usr/share/mysql
--with-mysql-includes=/usr/include/mysql --with-mysql-libraries=/usr/lib64/Mysql</p>

<p class="MsoNormal"> </p>

<p class="MsoNormal">ip_queue and iptables_ filter were modprobe + iptables
 -I FORWARD -j QUEUE</p>

<p class="MsoNormal"> </p>

<p class="MsoNormal">Can you help with this</p>

<p class="MsoNormal"> </p>

<p class="MsoNormal">Many thanks</p>

<p class="MsoNormal">Safwat</p>

<p class="MsoNormal"> </p>

<p class="MsoNormal"> </p>

</div>

</div>


<br>------------------------------------------------------------------------------<br>
<br>_______________________________________________<br>
Snort-users mailing list<br>
<a href="mailto:Snort-users@lists.sourceforge.net">Snort-users@...4626...ceforge.net</a><br>
Go to this URL to change user options or unsubscribe:<br>
<a href="https://lists.sourceforge.net/lists/listinfo/snort-users" target="_blank">https://lists.sourceforge.net/lists/listinfo/snort-users</a><br>
Snort-users list archive:<br>
<a href="http://www.geocrawler.com/redir-sf.php3?list=snort-users" target="_blank">http://www.geocrawler.com/redir-sf.php3?list=snort-users</a><br></blockquote></div><br>