Re: FW: snort Core Dump

[roman () danyliw com]

The list will need a bit more information to help in the debugging.
Find the core file generated by the seg fault and use gdb to 
do a backtrace.

$ gdb snort core
gdb> backtrace

Send the resulting output back to the list.

Roman

> I have installed snort 1.8.1 with the latest rules files and a snort.config
> that differs from the one supplied with the rules by only the DNS server and
> home net definition.   Can anyone suggest why I might be getting this
> segmentation fault?
>
> [root@localhost rich]# /usr/local/bin/snort -l /home/rich/snort/logs/ -c 
> /etc/snort/snort.conf
> Log directory = /home/rich/snort/logs/
>  
>         --== Initializing Snort ==--
> Checking PID path...
> PATH_VARRUN is set to /var/run/ on this operating system
>  
> Initializing Network Interface eth0
> Decoding Ethernet on interface eth0
> Initializing Preprocessors!
> Initializing Plug-ins!
> Initializating Output Plugins!
> Parsing Rules file /etc/snort/snort.conf
>  
> +++++++++++++++++++++++++++++++++++++++++++++++++++
> Initializing rule chains...
> No arguments to frag2 directive, setting defaults to:
>     Fragment timeout: 60 seconds
>     Fragment memory cap: 4194304 bytes
> Stream4 config:
>     Stateful inspection: ACTIVE
>     Session statistics: INACTIVE
>     Session timeout: 30 seconds
>     Session memory cap: 8388608 bytes
>     State alerts: INACTIVE
>     Scan alerts: ACTIVE
> No arguments to stream4_reassemble, setting defaults:
>      Reassemble client: ACTIVE
>      Reassemble server: INACTIVE
>      Reassemble ports: 21 23 25 53 80 143 110 111 513
>      Reassembly alerts: ACTIVE
> Back Orifice detection brute force: DISABLED
> Using LOCAL time
> Segmentation fault (core dumped)
>
>
>
> === === === === === === === === ===
> Richard Hall
> Systems Administrator
> Information Security Group
> Royal Holloway, University of London
> Tel: +44 (0)1784 44 3111
> Fax: +44 (0)1784 430766
> === === === === === === === === ===



---------------------------------------------
This message was sent using Voicenet WebMail.
      http://www.voicenet.com/webmail/



_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users