--
Martin Roesch
roeschmd.prestige.net
http://www.snort.org

attached mail follows:

Hmm, looks like a problem with the stream reassembler. Mr Cramer? :)

-Marty

Steve Hutchins wrote: > > gdb shows : > > [*] Rule Head 152 > CheckSrcIPEqual: Mismatch on SIP > => Header check failed, checking next node > [*] Rule Head 153 > CheckSrcIPEqual: Mismatch on SIP > => Header check failed, checking next node > [*] Rule Head 154 > CheckSrcIPEqual: Mismatch on SIP > => Header check failed, checking next node > [*] Evaluating rule list: pass > Detecting on TcpList > [*] Evaluating rule list: log > Detecting on TcpList > Checking tags list (if check_tags_flag = 1) > calling CheckTagList > bailing from CheckTagList, TagHead == NULL > > Program received signal SIGSEGV, Segmentation fault. > 0x401ec46d in memcpy () > (gdb) where > #0 0x401ec46d in memcpy () > #1 0x7b in ?? () > #2 0x2add2 in TcpStreamPacket (p=0xdfbfd2e8) at spp_tcp_stream.c:428 > #3 0x119c8 in Preprocess (p=0xdfbfd2e8) at rules.c:3180 > #4 0x219d in ProcessPacket (user=0x0, pkthdr=0x79f0c, pkt=0x79f1e "") at > snort.c:490 > #5 0x4006a151 in pcap_read () > #6 0x4007b61b in pcap_loop () > #7 0x492e in InterfaceThread (arg=0x0) at snort.c:1358 > #8 0x2088 in main (argc=5, argv=0xdfbfd850) at snort.c:424 > > Steve > > _______________________________________________ > Snort-users mailing list > Snort-userslists.sourceforge.net > Go to this URL to change user options or unsubscribe: > http://lists.sourceforge.net/lists/listinfo/snort-users > Snort-users list archive: > http://www.geocrawler.com/redir-sf.php3?list=snort-users

--
Martin Roesch
roeschmd.prestige.net
http://www.snort.org
_______________________________________________
Snort-users mailing list
Snort-userslists.sourceforge.net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]