Re: snort-prelude and OpenBSD

Hi Yoan,
when i run snort in interactive mode in gdb i cant type bt.
i send you last 50 lines:


Initializing Network Interface vic0
Decoding Ethernet on interface vic0
11 Sep 03:21:06 (process:24895) CRITICAL: assertion 'buf' failed
(prelude-string.c:407 prelude_string_set_dup)
11 Sep 03:21:06 (process:24895) INFO: Connecting to 127.0.0.1:4690
prelude Manager server.
11 Sep 03:21:07 (process:24895) INFO: TLS authentication succeed with
Prelude Manager.

[ Port Based Pattern Matching Memory ]
+-[AC-BNFA Search Info Summary]------------------------------
| Instances        : 768
| Patterns         : 134749
| Pattern Chars    : 1346965
| Num States       : 989476
| Num Match States : 154757
| Memory           :   22.45Mbytes
|   Patterns       :   3.85M
|   Match Lists    :   6.47M
|   Transitions    :   11.96M
+-------------------------------------------------

        --== Initialization Complete ==--

   ,,_     -*> Snort! <*-
  o"  )~   Version 2.8.2.2 (Build 18)
   ''''    By Martin Roesch & The Snort Team: http://www.snort.org/team.html
           (C) Copyright 1998-2008 Sourcefire Inc., et al.
           Using PCRE version: 7.7 2008-05-07

           Rules Engine: SF_SNORT_DETECTION_ENGINE  Version 1.8  <Build 14>
           Preprocessor Object: SF_SSH  Version 1.1  <Build 1>
           Preprocessor Object: SF_SMTP  Version 1.1  <Build 7>
           Preprocessor Object: SF_FTPTELNET  Version 1.1  <Build 10>
           Preprocessor Object: SF_DNS  Version 1.1  <Build 2>
           Preprocessor Object: SF_DCERPC  Version 1.1  <Build 4>
Not Using PCAP_FRAMES




On Tue, Sep 16, 2008 at 1:40 PM, Yoann Vandoorselaere
<[email protected]> wrote:
> Hi Gregory,
>
> Could you please retry without starting snort as a daemon?
>
> Regards,
>
> Le mercredi 10 septembre 2008 à 15:08 +0300, Gregory Podgorodesky a
> écrit :
>> I've installed 0.9.20.2 and compiled again snort-2.8.2,the result is the same.
>> this is from gdb output:
>> (gdb) bt
>> #0  0x0fa353e5 in poll () from /usr/lib/libc.so.48.0
>> #1  0x013931a4 in _thread_kern_poll (wait_reqd=1) at
>> /usr/src/lib/libpthread/uthread/uthread_kern.c:760
>> #2  0x01392ce3 in _thread_kern_sched (scp=0x0) at
>> /usr/src/lib/libpthread/uthread/uthread_kern.c:382
>> #3  0x0139302f in _thread_kern_sched_state (state=557338824,
>> fname=0x213850c8 "", lineno=557338824)
>>     at /usr/src/lib/libpthread/uthread/uthread_kern.c:550
>> #4  0x0138cf91 in nanosleep (time_to_sleep=0xcfbe56a8,
>> time_remaining=0xcfbe56a0)
>>     at /usr/src/lib/libpthread/uthread/uthread_nanosleep.c:84
>> #5  0x0fa4e10e in sleep (seconds=557338824) at /usr/src/lib/libc/gen/sleep.c:45
>> #6  0x1c01b994 in GoDaemon () at util.c:1970
>> #7  0x1c014caf in SnortMain (argc=10, argv=0x200) at snort.c:980
>> #8  0x1c0145d7 in main (argc=10, argv=0xcfbe57a4) at snort.c:401
>>
>> On Wed, Sep 3, 2008 at 3:59 PM, Yoann Vandoorselaere
>> <[email protected]> wrote:
>> > Le mercredi 03 septembre 2008 à 09:39 +0300, Gregory Podgorodesky a
>> > écrit :
>> >> without prelude support it works fine.
>> >> i've created 2 vmware environments:
>> >> 1 OpenBSD 4.3 with default packages snort and prelude.
>> >> without prelude support it works and with it don't.
>> >> 2 OpenBSD 4.3 with snort and prelude compiled from sources
>> >
>> > Could you please try to run Snort within gdb:
>> >
>> > gdb /path/to/snort
>> > run <snort arguments that you use>
>> >
>> > [crash should occur here]
>> >
>> > Type "bt", and send us the resulting backtrace.
>> >
>> > Regards,
>> >
>> > --
>> > Yoann Vandoorselaere | Responsable R&D / CTO | PreludeIDS Technologies
>> > Tel: +33 (0)8 70 70 21 58                  Fax: +33(0)4 78 42 21 58
>> > http://www.prelude-ids.com
>> >
>> >
> --
> Yoann Vandoorselaere | Responsable R&D / CTO | PreludeIDS Technologies
> Tel: +33 (0)8 70 70 21 58                  Fax: +33(0)4 78 42 21 58
> http://www.prelude-ids.com
>
>
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user