[Snort-users] 2.0.3 strange problems

Note in advance: these reports are somewhat incomplete as I'm still
testing the problems with 2.0.3 and trying to characterize them. I'm
posting a note so that others can keep an eye out for similar problems. If
I figure out more, I'll post more detail.. any requests for tests/info are
welcomed, but I'm refraining from posting everything about my whole system
to avoid undue list clutter.



After switching from 2.0.2, I've been having some severe problems with
2.0.3 on my system.
One seems to be a parser bug, the other is a memory fault randomly
crashing snort.


First, it seems to run rules in my icmp.rules file which are commented
out... I had to physically remove the lines from the config file to get it
to not fire off speedera ping alerts (which I really do not care at all
about since they fire off at my DNS server every time it queries for
windows update). This problem, while strange and annoying, does at least
have a work-around.

And yes, I did grep to make sure the rule was in no other files, and I did
search my system for other copies of icmp.rules and found none other than
the unpacked tarballs in a non-root user's home directory.


Second, I've observed my daemonized snort would silently disappear from my
process list for no apparent reason, with no complaints in
/var/log/messages or in <snort's chrooted directory>/var/log/snort/alert.

In the first hour that I had snort 2.0.3 running, I had it unexpectedly
terminate on me 3 times.

Eventually I ran it in console mode, and got a "memory fault" message out
of it, but nothing else useful:

--== Initialization Complete ==--

-*> Snort! <*-
Version 2.0.3 (Build 95)
By Martin Roesch (roesch@sourcefire.com, www.snort.org)
Memory fault
bash#

The time to memory fault varies, and can be as few as a single minute, or
as long as half an hour.

Note that while running snort consumes 38m, this is on a 128 mb real memory
/ 64mb swap OpenBSD system. Under normal conditions only 61mb of physical
ram are used, and only 4k of swap is used, leaving >128m of virtual memory
unused. There is no sign of increasing memory load from snort prior to
failure. It's a nice stable 38m.

Forcing some rules to alert doesn't cause it to crash or increase in memory
usage, so it's not related to the first time it tries to alert in general,
although it may be related to the first time it runs a particular rule.

Criteria: I'm using snort setuid and chroot, portscan2 and spp_conversation
are commented out in my configuration.

Command line used for console-mode run is the same as I use for daemon mode
minus the -D, and is the same as I've been using with 2.0.0 and 2.0.2:

/home/snort/sbin/snort -k none -c /home/snort/etc/snort.conf -t /home/snort
-l /home/snort/var/log/snort -u snortuser -g nogroup -i xl0








-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
Does SourceForge.net help you be more productive? Does it
help you create better code? SHARE THE LOVE, and help us help
YOU! Click Here: http://sourceforge.net/donate/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users