Re: 2.6.1.3 - FATAL ERROR: SpoUnified: write failed: Bad address

[Darryl Taylor <darryl.taylor () sourcefire com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Sorry, didn't notice the the error in the title. Must be tired.  
Anyway compile with --enable-debug option. Then do "export  
SNORT_DEBUG=-1". Then run snort and let it crash. You could also add  
strace. Lots of debugging output. Post the output. Maybe that will  
give more of a hint. Last line of defense is the core. Also just out  
of curiosity, is there any correlation with the crash and the size of  
the file being written to?

- ------------------

Darryl Taylor
Security Engineer

Fingerprint: AEA7 16DB 2DC3 0C3E 43A9 F1B6 E25A 6A7C 16F2 68B6
Key: http://demo.sourcefire.com/dtaylor.pgp.key




On Mar 9, 2007, at 1:21 PM, Darryl Taylor wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Can you provide the error message and possibly get a core dump. Might
> not want to post the core file but have it ready to send to someone
> who will be tracking down the error. To generate the core file,
> ensure you enter the following command "unlimit -c unlimited".
>
> - ------------------
>
> Darryl Taylor
> Security Engineer
>
> Fingerprint: AEA7 16DB 2DC3 0C3E 43A9 F1B6 E25A 6A7C 16F2 68B6
> Key: http://demo.sourcefire.com/dtaylor.pgp.key
>
>
>
>
>
>
>
>
>
> On Feb 21, 2007, at 4:54 PM, Petersen, Mark wrote:
>
> > Hi,
> >
> > I'm having trouble with snort 2.6.1.3 failing with this fatal error
> > on a
> > amd64 box (Sun V20z) running Ubuntu 6.10.
> >
> > I compiled this in a pretty standard way:
> > ./configure --prefix=/usr/local/snort-2.6.1.3 --enable-
> > dynamicplugin &&
> > make && make install
> >
> > And it will run for awhile, but eventually fails.  Then barnyard  
> > fails
> > after tring to read the file with a bad write.  I did apply the 64- 
> > bit
> > patch to barnyard (it wouldn't run at all without it.)
> >
> > Any suggestions besides rolling back to 2.4.x or compiling for a 32-
> > bit
> > architecture?  I'd be happy to provide further information, but at
> > this
> > point I don't really know what else would be relevant.
> >
> > Thanks,
> > mark
> >
> > --------------------------------------------------------------------- 
> > -
> > ---
> > Take Surveys. Earn Cash. Influence the Future of IT
> > Join SourceForge.net's Techsay panel and you'll get the chance to
> > share your
> > opinions on IT & business topics through brief surveys-and earn cash
> > http://www.techsay.com/default.php?
> > page=join.php&p=sourceforge&CID=DEVDEV
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.5 (Darwin)
>
> iD8DBQFF8aWp4lpqfBbyaLYRAsIAAKCMVHyl4nbUK5xu3dMs4XXNihbiowCfVqs6
> CBwWP7n5BmWa0sBNan5d80c=
> =psel
> -----END PGP SIGNATURE-----
>
> ---------------------------------------------------------------------- 
> ---
> Take Surveys. Earn Cash. Influence the Future of IT
> Join SourceForge.net's Techsay panel and you'll get the chance to  
> share your
> opinions on IT & business topics through brief surveys-and earn cash
> http://www.techsay.com/default.php? 
> page=join.php&p=sourceforge&CID=DEVDEV
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Darwin)

iD8DBQFF8cpp4lpqfBbyaLYRAopIAKCDUzbr9q4bteLE8S1AbkMcR1mJ8gCgt6hM
VgwC7DgVAhMLY1NbnYrziv0=
=SKli
-----END PGP SIGNATURE-----

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users