|
|
| Applications |
| Mailing Lists |
| Miscellaneous |
| Operating Systems |
| Programming |
[Snort-devel] Re: [Snort-users] Segfault on fun funy rule
Date: Thu Feb 26 2004 - 03:46:07 EST
Ok Ok, don't burn me. I followed the FAQ and look where it got me ;) I use gdb once in never ;) This is what I meant to sent. For fear that snipping will decrease reproducibility I've included it all :D
In this case bad stuff first:
Program received signal SIGSEGV, Segmentation fault. 0x001a9153 in strlen () from /lib/tls/libc.so.6
(gdb) where
#0 0x001a9153 in strlen () from /lib/tls/libc.so.6
#1 0x001a8e85 in strdup () from /lib/tls/libc.so.6
#2 0x0807bfe3 in ParseFlowArgs (data=0x0, otn=0x9e66ad8) at
sp_clientserver.c:143
#3 0x0807bfc4 in FlowInit (data=0x0, otn=0x9e66ad8, protocol=6) at
sp_clientserver.c:119
#4 0x08056ea4 in ParseRuleOptions (
rule=0xbfec0fb0 "alert tcp any any -> any any (msg:\"Telnet login as
root\";content:\"root\";flow:from_client:established;", rule_type=2,
protocol=6) at parser.c:1776
#5 0x08055703 in ParseRule (rule_file=0x9e65a48,
prule=0xbfec3060 "alert tcp $EXTERNAL_NET any -> $TELNET_SERVERS any
(msg:\"Telnet login as
root\";content:\"root\";flow:from_client:established;)", inclevel=1) at
parser.c:753
#6 0x08054870 in ParseRulesFile (file=0x9e65420
"/opt/snort/rules/local.rules", inclevel=1) at parser.c:254
#7 0x08054f6c in ParseRule (rule_file=0x9e40598, prule=0xbfec55b0
"include $RULE_PATH/local.rules", inclevel=0)
at parser.c:525
#8 0x08054870 in ParseRulesFile (file=0x9e3ec60
"/etc/snort/snort.conf", inclevel=0) at parser.c:254
#9 0x0805cb2d in SnortMain (argc=5, argv=0xbfec5b24) at snort.c:480
#10 0x0805c572 in main (argc=5, argv=0xbfec5b24) at snort.c:168
(gdb) bt
#0 0x001a9153 in strlen () from /lib/tls/libc.so.6
#1 0x001a8e85 in strdup () from /lib/tls/libc.so.6
#2 0x0807bfe3 in ParseFlowArgs (data=0x0, otn=0x9e66ad8) at
sp_clientserver.c:143
#3 0x0807bfc4 in FlowInit (data=0x0, otn=0x9e66ad8, protocol=6) at
sp_clientserver.c:119
#4 0x08056ea4 in ParseRuleOptions (
rule=0xbfec0fb0 "alert tcp any any -> any any (msg:\"Telnet login as
root\";content:\"root\";flow:from_client:established;", rule_type=2,
protocol=6) at parser.c:1776
#5 0x08055703 in ParseRule (rule_file=0x9e65a48,
prule=0xbfec3060 "alert tcp $EXTERNAL_NET any -> $TELNET_SERVERS any
(msg:\"Telnet login as
root\";content:\"root\";flow:from_client:established;)", inclevel=1) at
parser.c:753
#6 0x08054870 in ParseRulesFile (file=0x9e65420
"/opt/snort/rules/local.rules", inclevel=1) at parser.c:254
#7 0x08054f6c in ParseRule (rule_file=0x9e40598, prule=0xbfec55b0
"include $RULE_PATH/local.rules", inclevel=0)
at parser.c:525
#8 0x08054870 in ParseRulesFile (file=0x9e3ec60
"/etc/snort/snort.conf", inclevel=0) at parser.c:254
#9 0x0805cb2d in SnortMain (argc=5, argv=0xbfec5b24) at snort.c:480
#10 0x0805c572 in main (argc=5, argv=0xbfec5b24) at snort.c:168
Now the Rest of IT
(gdb) run -T -v -c /etc/snort/snort.conf
Starting program: /opt/snort/bin/snort -T -v -c /etc/snort/snort.conf
Running in IDS mode
Log directory = /var/log/snort
Initializing Network Interface eth0
--== Initializing Snort ==--
Initializing Output Plugins!
Decoding Ethernet on interface eth0
Initializing Preprocessors!
Initializing Plug-ins!
Keyword | Preprocessor @
portscan : 0x8084559 portscan-ignorehosts: 0x8085033 rpc_decode : 0x80855e2 bo : 0x80807bf telnet_decode: 0x808f127 stream4 : 0x80870b3 stream4_reassemble: 0x8087bfa frag2 : 0x8081478 arpspoof : 0x807fd00 arpspoof_detect_host: 0x807fe1d conversation : 0x80903a5 portscan2 : 0x80931b8 portscan2-ignorehosts: 0x8091c3c portscan2-ignoreports-from: 0x8092059 portscan2-ignoreports-to: 0x8092079 http_inspect : 0x8096dc0 http_inspect_server: 0x8096dc0 PerfMonitor : 0x808f70f flow : 0x8099ad3 flow-portscan: 0x809aa4a ------------------------------------------------- ------------------------------------------------- Keyword | Plugin Registered @ ------------------------------------------------- content : 0x8078319 content-list : 0x807824c offset : 0x8078469 depth : 0x80785ae nocase : 0x8078709 rawbytes : 0x80787bd regex : 0x8078aa6 uricontent : 0x80783c1 distance : 0x8078812 within : 0x807895c flags : 0x807af47 itype : 0x80762fb icode : 0x8075a9f ttl : 0x807ba43 id : 0x8076f9b ack : 0x807ad87 seq : 0x807b623 dsize : 0x8075507 ipopts : 0x80777ff rpc : 0x8079fc7 icmp_id : 0x8075eeb icmp_seq : 0x80760f3 session : 0x807a66f tos : 0x807759b fragbits : 0x8076743 fragoffset : 0x8076c6c window : 0x807b7bd ip_proto : 0x8077153 sameip : 0x807741f flow : 0x807bf5b byte_test : 0x807c882 byte_jump : 0x807d46e isdataat : 0x807ebca pcre : 0x807def4 flowbits : 0x807f2cd ------------------------------------------------- ------------------------------------------------- Keyword | Output @ ------------------------------------------------- alert_syslog : 0x806de85 log_tcpdump : 0x8072735 database : 0x806fd3d alert_fast : 0x806d2f5 alert_full : 0x806d93d alert_unixsock: 0x806e8e5 alert_CSV : 0x806ede5 log_null : 0x8072671 log_unified : 0x8073c98 alert_unified: 0x80739f5 unified : 0x8072ccf log_ascii : 0x8074259 alert_sf_socket: 0x8074cfc alert_sf_socket_sid: 0x8074e01 -------------------------------------------------
Parsing Rules file /etc/snort/snort.conf
+++++++++++++++++++++++++++++++++++++++++++++++++++Initializing rule chains...
,-----------[Flow Config]---------------------- | Stats Interval: 0 | Hash Method: 2 | Memcap: 10485760 | Rows : 4099
| Overhead Bytes: 16400(%0.16)
`----------------------------------------------No arguments to frag2 directive, setting defaults to:
Fragment timeout: 60 seconds
Fragment memory cap: 4194304 bytes
Fragment min_ttl: 0
Fragment ttl_limit: 5
Fragment Problems: 0
Self preservation threshold: 500
Self preservation period: 90
Suspend threshold: 1000
Suspend period: 30
Stream4 config:
Stateful inspection: ACTIVE
Session statistics: INACTIVE
Session timeout: 30 seconds
Session memory cap: 8388608 bytes
State alerts: INACTIVE
Evasion alerts: INACTIVE
Scan alerts: INACTIVE
Log Flushed Streams: INACTIVE
MinTTL: 1
TTL Limit: 5
Async Link: 0
State Protection: 0
Self preservation threshold: 50
Self preservation period: 90
Suspend threshold: 200
Suspend period: 30
Stream4_reassemble config:
Server reassembly: INACTIVE
Client reassembly: ACTIVE
Reassembler alerts: ACTIVE
Zero out flushed packets: INACTIVE
flush_data_diff_size: 500
Ports: 21 23 25 53 80 110 111 143 513 1433
Emergency Ports: 21 23 25 53 80 110 111 143 513 1433
HttpInspect Config:
GLOBAL CONFIG
Max Pipeline Requests: 0
Inspection Type: STATELESS
Detect Proxy Usage: NO
IIS Unicode Map Filename: /etc/snort/unicode.map
IIS Unicode Map Codepage: 1252
DEFAULT SERVER CONFIG:
Ports: 80 8080 8180
Flow Depth: 300
Max Chunk Length: 500000
Inspect Pipeline Requests: YES
URI Discovery Strict Mode: NO
Allow Proxy Usage: NO
Disable Alerting: NO
Oversize Dir Length: 500
Only inspect URI: NO
Ascii: YES alert: NO
Double Decoding: YES alert: YES
%U Encoding: YES alert: YES
Bare Byte: YES alert: YES
Base36: OFF
UTF 8: OFF
IIS Unicode: YES alert: YES
Multiple Slash: YES alert: NO
IIS Backslash: YES alert: NO
Directory: YES alert: NO
Apache WhiteSpace: YES alert: YES
IIS Delimiter: YES alert: YES
IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG
Non-RFC Compliant Characters: NONE
rpc_decode arguments:
Ports to decode RPC on: 111 32771
alert_fragments: INACTIVE
alert_large_fragments: ACTIVE
alert_incomplete: ACTIVE
alert_multiple_requests: ACTIVE
telnet_decode arguments:
Ports to decode telnet on: 21 23 25 119
Program received signal SIGSEGV, Segmentation fault. 0x001a9153 in strlen () from /lib/tls/libc.so.6
> > Instead of "run snort ...." try just "runSF.Net is sponsored by: Speed Start Your Linux Apps Now. Build and deploy apps & Web services for Linux with a free DVD software kit from IBM. Click Now! http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click" without the word > 'snort'. Libpcap is seeing that and trying to interpret it as a BPF style > filter, hence the syntax error with OpenPcap. > > Cheers! > > ----- -------------------------------------------------------
Snort-devel mailing list
Snort-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-devel Received on Thu Feb 26 03:56:21 2004
This archive was generated by hypermail 2.1.8 : Wed Aug 23 2006 - 14:08:10 EDT
|
Contact Us Legal Notices Order Services Online Pantek Home Privacy Policy IT news Site Map Pantek Library |