Snort mailing list archives
Re: Segfault on fun funy rule
From: "Jason Monroe \"JC\"" <monroe () nas nasa gov>
Date: Thu, 26 Feb 2004 00:46:07 -0800
Ok Ok, don't burn me. I followed the FAQ and look where it got me ;) I
use gdb once in never ;) This is what I meant to sent. For fear that
snipping will decrease reproducibility I've included it all :D
In this case bad stuff first:
Program received signal SIGSEGV, Segmentation fault.
0x001a9153 in strlen () from /lib/tls/libc.so.6
(gdb) where
#0 0x001a9153 in strlen () from /lib/tls/libc.so.6
#1 0x001a8e85 in strdup () from /lib/tls/libc.so.6
#2 0x0807bfe3 in ParseFlowArgs (data=0x0, otn=0x9e66ad8) at
sp_clientserver.c:143
#3 0x0807bfc4 in FlowInit (data=0x0, otn=0x9e66ad8, protocol=6) at
sp_clientserver.c:119
#4 0x08056ea4 in ParseRuleOptions (
rule=0xbfec0fb0 "alert tcp any any -> any any (msg:\"Telnet login as
root\";content:\"root\";flow:from_client:established;", rule_type=2,
protocol=6) at parser.c:1776
#5 0x08055703 in ParseRule (rule_file=0x9e65a48,
prule=0xbfec3060 "alert tcp $EXTERNAL_NET any -> $TELNET_SERVERS any
(msg:\"Telnet login as
root\";content:\"root\";flow:from_client:established;)", inclevel=1) at
parser.c:753
#6 0x08054870 in ParseRulesFile (file=0x9e65420
"/opt/snort/rules/local.rules", inclevel=1) at parser.c:254
#7 0x08054f6c in ParseRule (rule_file=0x9e40598, prule=0xbfec55b0
"include $RULE_PATH/local.rules", inclevel=0)
at parser.c:525
#8 0x08054870 in ParseRulesFile (file=0x9e3ec60
"/etc/snort/snort.conf", inclevel=0) at parser.c:254
#9 0x0805cb2d in SnortMain (argc=5, argv=0xbfec5b24) at snort.c:480
#10 0x0805c572 in main (argc=5, argv=0xbfec5b24) at snort.c:168
(gdb) bt
#0 0x001a9153 in strlen () from /lib/tls/libc.so.6
#1 0x001a8e85 in strdup () from /lib/tls/libc.so.6
#2 0x0807bfe3 in ParseFlowArgs (data=0x0, otn=0x9e66ad8) at
sp_clientserver.c:143
#3 0x0807bfc4 in FlowInit (data=0x0, otn=0x9e66ad8, protocol=6) at
sp_clientserver.c:119
#4 0x08056ea4 in ParseRuleOptions (
rule=0xbfec0fb0 "alert tcp any any -> any any (msg:\"Telnet login as
root\";content:\"root\";flow:from_client:established;", rule_type=2,
protocol=6) at parser.c:1776
#5 0x08055703 in ParseRule (rule_file=0x9e65a48,
prule=0xbfec3060 "alert tcp $EXTERNAL_NET any -> $TELNET_SERVERS any
(msg:\"Telnet login as
root\";content:\"root\";flow:from_client:established;)", inclevel=1) at
parser.c:753
#6 0x08054870 in ParseRulesFile (file=0x9e65420
"/opt/snort/rules/local.rules", inclevel=1) at parser.c:254
#7 0x08054f6c in ParseRule (rule_file=0x9e40598, prule=0xbfec55b0
"include $RULE_PATH/local.rules", inclevel=0)
at parser.c:525
#8 0x08054870 in ParseRulesFile (file=0x9e3ec60
"/etc/snort/snort.conf", inclevel=0) at parser.c:254
#9 0x0805cb2d in SnortMain (argc=5, argv=0xbfec5b24) at snort.c:480
#10 0x0805c572 in main (argc=5, argv=0xbfec5b24) at snort.c:168
Now the Rest of IT
(gdb) run -T -v -c /etc/snort/snort.conf
Starting program: /opt/snort/bin/snort -T -v -c /etc/snort/snort.conf
Running in IDS mode
Log directory = /var/log/snort
Initializing Network Interface eth0
--== Initializing Snort ==--
Initializing Output Plugins!
Decoding Ethernet on interface eth0
Initializing Preprocessors!
Initializing Plug-ins!
-------------------------------------------------
Keyword | Preprocessor @
-------------------------------------------------
portscan : 0x8084559
portscan-ignorehosts: 0x8085033
rpc_decode : 0x80855e2
bo : 0x80807bf
telnet_decode: 0x808f127
stream4 : 0x80870b3
stream4_reassemble: 0x8087bfa
frag2 : 0x8081478
arpspoof : 0x807fd00
arpspoof_detect_host: 0x807fe1d
conversation : 0x80903a5
portscan2 : 0x80931b8
portscan2-ignorehosts: 0x8091c3c
portscan2-ignoreports-from: 0x8092059
portscan2-ignoreports-to: 0x8092079
http_inspect : 0x8096dc0
http_inspect_server: 0x8096dc0
PerfMonitor : 0x808f70f
flow : 0x8099ad3
flow-portscan: 0x809aa4a
-------------------------------------------------
-------------------------------------------------
Keyword | Plugin Registered @
-------------------------------------------------
content : 0x8078319
content-list : 0x807824c
offset : 0x8078469
depth : 0x80785ae
nocase : 0x8078709
rawbytes : 0x80787bd
regex : 0x8078aa6
uricontent : 0x80783c1
distance : 0x8078812
within : 0x807895c
flags : 0x807af47
itype : 0x80762fb
icode : 0x8075a9f
ttl : 0x807ba43
id : 0x8076f9b
ack : 0x807ad87
seq : 0x807b623
dsize : 0x8075507
ipopts : 0x80777ff
rpc : 0x8079fc7
icmp_id : 0x8075eeb
icmp_seq : 0x80760f3
session : 0x807a66f
tos : 0x807759b
fragbits : 0x8076743
fragoffset : 0x8076c6c
window : 0x807b7bd
ip_proto : 0x8077153
sameip : 0x807741f
flow : 0x807bf5b
byte_test : 0x807c882
byte_jump : 0x807d46e
isdataat : 0x807ebca
pcre : 0x807def4
flowbits : 0x807f2cd
-------------------------------------------------
-------------------------------------------------
Keyword | Output @
-------------------------------------------------
alert_syslog : 0x806de85
log_tcpdump : 0x8072735
database : 0x806fd3d
alert_fast : 0x806d2f5
alert_full : 0x806d93d
alert_unixsock: 0x806e8e5
alert_CSV : 0x806ede5
log_null : 0x8072671
log_unified : 0x8073c98
alert_unified: 0x80739f5
unified : 0x8072ccf
log_ascii : 0x8074259
alert_sf_socket: 0x8074cfc
alert_sf_socket_sid: 0x8074e01
-------------------------------------------------
Parsing Rules file /etc/snort/snort.conf
+++++++++++++++++++++++++++++++++++++++++++++++++++
Initializing rule chains...
,-----------[Flow Config]----------------------
| Stats Interval: 0
| Hash Method: 2
| Memcap: 10485760
| Rows : 4099
| Overhead Bytes: 16400(%0.16)
`----------------------------------------------
No arguments to frag2 directive, setting defaults to:
Fragment timeout: 60 seconds
Fragment memory cap: 4194304 bytes
Fragment min_ttl: 0
Fragment ttl_limit: 5
Fragment Problems: 0
Self preservation threshold: 500
Self preservation period: 90
Suspend threshold: 1000
Suspend period: 30
Stream4 config:
Stateful inspection: ACTIVE
Session statistics: INACTIVE
Session timeout: 30 seconds
Session memory cap: 8388608 bytes
State alerts: INACTIVE
Evasion alerts: INACTIVE
Scan alerts: INACTIVE
Log Flushed Streams: INACTIVE
MinTTL: 1
TTL Limit: 5
Async Link: 0
State Protection: 0
Self preservation threshold: 50
Self preservation period: 90
Suspend threshold: 200
Suspend period: 30
Stream4_reassemble config:
Server reassembly: INACTIVE
Client reassembly: ACTIVE
Reassembler alerts: ACTIVE
Zero out flushed packets: INACTIVE
flush_data_diff_size: 500
Ports: 21 23 25 53 80 110 111 143 513 1433
Emergency Ports: 21 23 25 53 80 110 111 143 513 1433
HttpInspect Config:
GLOBAL CONFIG
Max Pipeline Requests: 0
Inspection Type: STATELESS
Detect Proxy Usage: NO
IIS Unicode Map Filename: /etc/snort/unicode.map
IIS Unicode Map Codepage: 1252
DEFAULT SERVER CONFIG:
Ports: 80 8080 8180
Flow Depth: 300
Max Chunk Length: 500000
Inspect Pipeline Requests: YES
URI Discovery Strict Mode: NO
Allow Proxy Usage: NO
Disable Alerting: NO
Oversize Dir Length: 500
Only inspect URI: NO
Ascii: YES alert: NO
Double Decoding: YES alert: YES
%U Encoding: YES alert: YES
Bare Byte: YES alert: YES
Base36: OFF
UTF 8: OFF
IIS Unicode: YES alert: YES
Multiple Slash: YES alert: NO
IIS Backslash: YES alert: NO
Directory: YES alert: NO
Apache WhiteSpace: YES alert: YES
IIS Delimiter: YES alert: YES
IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG
Non-RFC Compliant Characters: NONE
rpc_decode arguments:
Ports to decode RPC on: 111 32771
alert_fragments: INACTIVE
alert_large_fragments: ACTIVE
alert_incomplete: ACTIVE
alert_multiple_requests: ACTIVE
telnet_decode arguments:
Ports to decode telnet on: 21 23 25 119
Program received signal SIGSEGV, Segmentation fault.
0x001a9153 in strlen () from /lib/tls/libc.so.6
Instead of "run snort ...." try just "run <options>" without the word 'snort'. Libpcap is seeing that and trying to interpret it as a BPF style filter, hence the syntax error with OpenPcap. Cheers! -----
------------------------------------------------------- SF.Net is sponsored by: Speed Start Your Linux Apps Now. Build and deploy apps & Web services for Linux with a free DVD software kit from IBM. Click Now! http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Segfault on fun funy rule Jason Monroe "JC" (Feb 25)
- Re: Segfault on fun funy rule Erek Adams (Feb 25)
- Re: Segfault on fun funy rule Jason Monroe "JC" (Feb 26)
- Re: Segfault on fun funy rule Erek Adams (Feb 25)