snort problem on HP-UX 11.00 and TokenRing

[Karl Lovink <karl () lovink net>]

Hello there,

I'am trying to run snort v1.8.6 on HP-UX 11.00. Where I start snort the 
result is a bus error.

Stack trace:
#0  0x12ab4 in DecodeIP (pkt=0x40036332 "E", len=78, p=0x7f7f0808)
    at decode.c:1218
1218        if(p->iph->ip_ver != 4)
(gdb) where
#0  0x12ab4 in DecodeIP (pkt=0x40036332 "E", len=78, p=0x7f7f0808)
    at decode.c:1218
#1  0x12a68 in DecodeIP (pkt=0x7f7f0808 "\177\177\aX@\003c\032", 
    len=1073801096, p=0x60014) at decode.c:1199
#2  0x11ed8 in DecodeTRPkt (p=0x7f7f0808, pkthdr=0x7f7f0758, 
    pkt=0x4003631a "\030@\377\377\377\377\377\377\200@\201\002\032 
\2020\252\252\003") at decode.c:291
#3  0x997c in ProcessPacket (user=0x40036332 "E", pkthdr=0x58418, 
    pkt=0x40036332 "E") at snort.c:498
#4  0x4658c in pcap_read ()
#5  0x47834 in pcap_loop ()
#6  0x12a68 in DecodeIP (pkt=0x4002f788 "", len=7, p=0x4002fd40)
    at decode.c:1199

The environment is:
        HP-UX 11.00
        lan2 is a Tokenring device
        compiled with gcc v3.0.4
        system is a Nclass with 4 processors en 4GB mem
        used libpcap is the latest v0.7.1

I commented the frag2 and stream stuff out of snort.conf.

The compile flags are:
./configure --prefix=/opt/snort --with-mysql=/opt/mysql 
--with-openssl=/opt/openssl --with-libpcap-includes=/usr/local/include 
--with-lipcap-libraries=/usr/local/lib


Any idea what can cause the problem?

Greetz,
Karl

----------------------------------------- (on dvinuu01.lovink.net)


---------------------------------------------------------