Re: [Snort-users] Snort 2.4 + Stream4 + HDLC

Do you have the coredump?

gdb snortexe corefile
bt full
send output

Regards,

Will
On 12/11/06, Eric Hines <eric.hines@appliedwatch.com> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Can anyone tell me if their are problems with Snort 2.4.4's stream4
> preprocessor and HDLC frames?
>
> We have Snort hanging off an OC line watching HDLC traffic. When stream4
> is enabled Snort core dumps with a Signal 11. I originally thought it
> was the cache_clean_percent bug we found but it seems even after
> removing that value, snort still core dumps.
>
> If stream4 is disabled, Snort doesn't core and runs fine.
>
> Is stream4 not able to handle HDLC frames?
>
> Here is the entire line:
>
> preprocessor stream4: disable_evasion_alerts, timeout 60, memcap
> 204800000, cache_clean_sessions 5, self_preservation_threshold 3000,
> self_preservation_period 60, suspend_threshold 6000, suspend_period 15,
> suspend_period 15, max_sessions 65000
>
>
>
>
> - --
>
> Best Regards,
>
> Eric Hines, GCIA, CISSP
> CEO, President
> Applied Watch Technologies, LLC
> 1095 Pingree Road
> Suite 221
> Crystal Lake, IL 60014
> Toll Free: (877) 262-7593
> Fax: (847) 854-5106
> Cell: (847) 456-6785
> Web: www.appliedwatch.com
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.5 (Darwin)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
>
> iD8DBQFFfc5J1va6QYTV0EMRAifiAJ9osxLptNnbQxigrV4JMugd/uAe5wCeOoLZ
> BJ1iTLyW78a2t8Cxn/SINb0=
> =Xd+c
> -----END PGP SIGNATURE-----
>
> -------------------------------------------------------------------------
> Take Surveys. Earn Cash. Influence the Future of IT
> Join SourceForge.net's Techsay panel and you'll get the chance to share
your
> opinions on IT & business topics through brief surveys - and earn cash
> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
> _______________________________________________
> Snort-users mailing list
> Snort-users@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV

_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users