RE: Anyone have problems with aanval?

["Michael Scheidell" <scheidell () secnap net>]

> -----Original Message-----
> From: Nerijus Krukauskas [mailto:nkrukauskas () gmail com] 
> Sent: Friday, January 27, 2006 7:23 AM
> To: Michael Scheidell
> Cc: Snort Users
> Subject: Re: [Snort-users] Anyone have problems with aanval?

Packes looked random, or compressed.  Didn't see any text in them, no ip
addresses, no hostnames, just want looked like random or compressed
data.

>   BTW, what is the version of aanval you used? Just to see if 
> I was lucky by not using it or not driving it crazy.

Don't know without starting it up again, but it was fairly recent.

> > And besides, we turned it off in system options the day we 
> installed 
> > it. Did RTFM.
> >
> > Thanks for playing, next player?
>
>   Well, I'll join you, but just after my work hours (in ~3-4 
> hours from now). :)

Looks like it happened right after one of the engineers pushed the
'update to newest version' button.

I suspect the 'random/compressed' data war a tgz being send over and
over and over and over...
So, if there is a bug, its in the upgrade procedure.

Nasty one, considering the ids box on the same segment spend 7 hours
looking at about 3Mbs of tarballs.

I guess we will try upgrade by hand/tarball, wipe directory, upgrade
that way, see what happens.

What made things really bad was you could not stop it!

Even sending SEGV to php processes and httpd processes wouldn't stop it.

Have any problems associated with php safe_mode? New version requires
safe_mode to be OFF (at least to install).  That might be the issue.



-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid3432&bid#0486&dat1642
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users