Snort mailing list archives
snort crash in DecodeTCP
From: hung quy <hung_quy () yahoo com>
Date: Tue, 19 Jan 2016 21:20:51 +0000 (UTC)
Hello,I am running snort version 2.9.7.2-4 on Ubuntu 12.04 I have a crash while running snort as follows: (gdb) c Continuing. Program received signal SIGSEGV, Segmentation fault. in_chksum_tcp6 (dlen=<optimized out>, d=0x7fa9dd221fea, ph=0x7ffffebc5ff0) at checksum.h:252 252 checksum.h: No such file or directory. (gdb) bt #0 in_chksum_tcp6 (dlen=<optimized out>, d=0x7fa9dd221fea, ph=0x7ffffebc5ff0) at checksum.h:252 #1 DecodeTCP (pkt=0x7fa9dd217036 "\333", <incomplete sequence \363>, len=46085, p=0xe8ac20) at decode.c:5320 #2 0x0000000000410cd9 in DecodeEthPkt (p=0xe8ac20, pkthdr=<optimized out>, pkt=0x7fa9dd217000 "\304\064k\271\v\220\204\064\227\021\252Ć\335`") at decode.c:777 #3 0x0000000000430436 in ProcessPacket (p=0xe8ac20, pkthdr=<optimized out>, pkt=<optimized out>, ft=0x0) at snort.c:1849 #4 0x00000000004328e4 in PacketCallback (user=<optimized out>, pkthdr=0x7ffffebc60d0, pkt=0x7fa9dd217000 "\304\064k\271\v\220\204\064\227\021\252Ć\335`") at snort.c:1717 #5 0x00000000004eb3b4 in pcap_process_loop () #6 0x00007fa9f42e4fa9 in ?? () from /opt/pkgs/dart/lib/libpcap.so.1 #7 0x00000000004eb54b in pcap_daq_acquire () #8 0x0000000000451123 in DAQ_Acquire (max=<optimized out>, callback=<optimized out>, user=<optimized out>) at sfdaq.c:541 #9 0x0000000000433b2c in PacketLoop () at snort.c:3268 #10 SnortMain (argc=14, argv=<optimized out>) at snort.c:920 #11 0x00007fa9f3af376d in __libc_start_main () from /lib/x86_64-linux-gnu/libc.so.6 #12 0x000000000040555d in _start () Any help on this issue is very appreciated. Regards,Hung
------------------------------------------------------------------------------ Site24x7 APM Insight: Get Deep Visibility into Application Performance APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month Monitor end-to-end web transactions and take corrective actions now Troubleshoot faster and improve end-user experience. Signup Now! http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- snort crash in DecodeTCP hung quy (Jan 19)
- Re: snort crash in DecodeTCP Joel Esler (jesler) (Jan 19)