Re: Snort 1.7 dies on OpenBSD 2.9 after some time.

[Johan Simon Seland <johans () netfonds no>]

Ralf Hildebrandt <Ralf.Hildebrandt () innominate com> writes:

> Analyse the core dump using gdb; if necessary, rebuild snort with
> debugging enabled.

I have done that, the result from gdb is:
-----------------------------
Program terminated with signal 11, Segmentation fault.
Reading symbols from /usr/libexec/ld.so...done.
Reading symbols from /usr/lib/libpcap.so.1.1...done.
Reading symbols from /usr/lib/libm.so.0.1...done.
Reading symbols from /usr/lib/libssl.so.4.1...done.
Reading symbols from /usr/lib/libcrypto.so.4.1...done.
Reading symbols from /usr/lib/libc.so.26.2...done.
#0  0x225be in fragcompare (i=0x12f000, j=0x12f000)
    at /usr/ports/net/snort/work/snort-1.7/spp_defrag.c:171
171         if(SADDR(i) > SADDR(j))
----------------------------

In latest cvs this function has been altered quite a bit, including
the following cvs log:

----------------------------
revision 1.12
date: 2001/04/27 06:06:18;  author: roesch;  state: Exp;  lines: +20 -1
* fixed msg field parsing
* fixed core dump and checked for existence of ip header in defrag code
----------------------------

Since 1.7 is horribly unstable, I will try to compile from cvs. But I
don't like using cvs code on a production system.

Anyone knows when 1.8 will be released?
How stable is the current cvs tree?

-- 
Regards
Johan Seland
Programmer 
Net Fonds ASA

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users