Re: Segmentation Fault on Zeek 3.0.0

Jon Siwek <[email protected]> Mon, 30 Sep 2019 09:37:07 -0700
Newsgroups gmane.comp.security.detection.bro
Message-ID <CAMzgZ0LiyNmCcwS1Xz=v4Uu4YYQwFVy=uDGKrhHMB3qMUVN=LA@mail.gmail.com>
Can you provide more information on how to reproduce the issue (exact
scripts/plugins/pcaps that crash every time) ?  There's still a bug in
Zeek to fix here, but just adding `-t` and trying a few things hasn't
triggered it for me.

- Jon

On Fri, Sep 27, 2019 at 7:57 PM TQ <[email protected]> wrote:
>
> Hey Jon,
>
> Thanks for guidance on this!  You are absolutely right.  If I remove "-t ~/Desktop/logs/output.log", then that segmentation fault goes away.  I have not a clue why as it works fine for 2.6.2.  I thought something was wrong with the actual code.  Again, thanks for helping out with this!
>
> Thanks,
>
> On Fri, Sep 27, 2019 at 5:16 PM Jon Siwek <[email protected]> wrote:
>>
>> On Fri, Sep 27, 2019 at 9:47 AM TQ <[email protected]> wrote:
>>
>> > cd ~/Desktop/logs/ && sudo rm -f *.log && zeek -C -t ~/Desktop/logs/output.log -r ~/Desktop/pcap/ testPlugin1_pcap_1.pcapng
>>
>> The `-t` option isn't commonly used and could see it accidentally
>> breaking without anyone noticing.  It does still seem to work for me,
>> but you might try removing it to see if it makes a difference.
>>
>> But the best thing would be if you can provide the full directions to
>> be able to reproduce the segfault -- e.g. the plugin/script code along
>> with pcap and command-line you're using.
>>
>> If you can't share those, then next best thing would be if you can run
>> in a debugger (gdb, lldb) and share a stack trace of the segfault.
>>
>> - Jon

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek