Snort mailing list archives
Snort 2.4 + Stream4 + HDLC
From: Eric Hines <eric.hines () appliedwatch com>
Date: Mon, 11 Dec 2006 15:31:53 -0600
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Can anyone tell me if their are problems with Snort 2.4.4's stream4 preprocessor and HDLC frames? We have Snort hanging off an OC line watching HDLC traffic. When stream4 is enabled Snort core dumps with a Signal 11. I originally thought it was the cache_clean_percent bug we found but it seems even after removing that value, snort still core dumps. If stream4 is disabled, Snort doesn't core and runs fine. Is stream4 not able to handle HDLC frames? Here is the entire line: preprocessor stream4: disable_evasion_alerts, timeout 60, memcap 204800000, cache_clean_sessions 5, self_preservation_threshold 3000, self_preservation_period 60, suspend_threshold 6000, suspend_period 15, suspend_period 15, max_sessions 65000 - -- Best Regards, Eric Hines, GCIA, CISSP CEO, President Applied Watch Technologies, LLC 1095 Pingree Road Suite 221 Crystal Lake, IL 60014 Toll Free: (877) 262-7593 Fax: (847) 854-5106 Cell: (847) 456-6785 Web: www.appliedwatch.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFFfc5J1va6QYTV0EMRAifiAJ9osxLptNnbQxigrV4JMugd/uAe5wCeOoLZ BJ1iTLyW78a2t8Cxn/SINb0= =Xd+c -----END PGP SIGNATURE----- ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort 2.4 + Stream4 + HDLC Eric Hines (Dec 11)
- Re: Snort 2.4 + Stream4 + HDLC Will Metcalf (Dec 11)