Re: snort crash in TcpSessionCleanup

[Prithvi Telang <prithvi100 () gmail com>]

i have ported  the snort code for own purposes and now upgrading and
modifying that will take a lot of
time and effort..
Does any one encountered the similar situations where in  a user is trying
to do a http POST and
snort is trying to delete TCP LWsession and crash in  TcpSessionCleanup.


Thanks,
Prithvi


On Thu, May 20, 2010 at 5:20 PM, Todd Wease <twease () sourcefire com> wrote:

> Please update to snort 2.8.6 and see if the problem persists.
>
>
> On 05/20/2010 07:27 AM, Prithvi Telang wrote:
>
> Hi,
> I'm using sort engine 2.8.5
>  I have created my own directory structure with snort code  and using these
> names.
> Source file paths are absolutely fine..
>
> -Thanks,
> Prithvi
>
>
>
> On Thu, May 20, 2010 at 3:52 PM, Todd Wease <twease () sourcefire com> wrote:
>
> > The paths to source files in the backtrace don't look correct.  What
> > version of snort are you using?
> >
> >
> > On 05/20/2010 02:31 AM, Prithvi Telang wrote:
> >
> >  Hi All,
> >           i have configured snort as an application in FC11 linux and when
> > i'm trying to
> > to a http GET from a apache web server in FC11 i'm getting a snort crash
> > continuously.
> > bt and snort.conf are pasted here FYI.
> > any help is highly appriciated.
> >
> > Thanks,
> > Prithvi
> >
> >
> > (gdb) bt
> >
> > #0  0xb7348b39 in TcpSessionCleanup (lwssn=0x8d25028)
> >
> >     at /snort/common/src/snort_stream5_tcp.c:4056
> >
> > #1  0xb7345009 in DeleteLWSession (sessionCache=0x80dbba8, ssn=0x8d25028,
> >
> >     delete_reason=0xb738cfdf "closed normally")
> >
> >     at snort/common/src/snort_stream5_session.c:625
> >
> > #2  0xb734d59d in ProcessTcp (lwssn=0x8d25028, p=0xbffef230,
> > tdb=0xbffef170,
> >
> >     s5TcpPolicy=0xb5395008)
> >
> >     at snort/common/src/snort_stream5_tcp.c:7770
> >
> > #3  0xb7349574 in Stream5ProcessTcp (p=0xbffef230, lwssn=0x8d25028,
> > s5TcpPolicy=0xb5395008,
> >
> >     skey=0xbffef1c0)
> >
> >     at snort/common/src/snort_stream5_tcp.c:4495
> >
> > #4  0xb72cc474 in Stream5Process (p=0xbffef230, context=0x0)
> >
> >     at snort/common/src/spp_stream5.c:1099
> >
> > #5  0xb72f241e in Preprocess (p=0xbffef230)
> >
> >     at snort/common/src/detect.c:172
> >
> >
> > ------------------------------------------------------------------------------
> >
> >
> >
> >
> > _______________________________________________
> > Snort-users mailing listSnort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------------------------------

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users