Operating System - HP-UX
1833772 Members
2296 Online
110063 Solutions
New Discussion

can anyone tell what this mean from output of gdb?

 
HPP
Regular Advisor

can anyone tell what this mean from output of gdb?

# gdb snort core
HP gdb 2.1
Copyright 1986 - 1999 Free Software Foundation, Inc.
Hewlett-Packard Wildebeest 2.1 (based on GDB 5.0-hpwdb-20000630)
Wildebeest is free software, covered by the GNU General Public License, and
you are welcome to change it and/or distribute copies of it under certain
conditions. Type "show copying" to see the conditions. There is
absolutely no warranty for Wildebeest. Type "show warranty" for details.
Wildebeest was built for PA-RISC 1.1 or 2.0 (narrow), HP-UX 11.00.
..
Core was generated by `snort'.
Program terminated with signal 10, Bus error.

warning: The shared libraries were not privately mapped; setting a
breakpoint in a shared library will not work until you rerun the program.

#0 DecodeIP (pkt=0x400480a6 "E", len=1596, p=0x7f7f10d8) at decode.c:1194
1194 if(p->iph->ip_ver != 4)
(gdb) where
#0 DecodeIP (pkt=0x400480a6 "E", len=1596, p=0x7f7f10d8) at decode.c:1194
#1 0x1d56c in DecodeEthPkt (p=0x4000daa2, pkthdr=0x400130c8, pkt=0x7f7f0a98 "\177\177\t\350@\003\261\362") at decode.c:62
#2 0x1d56c in DecodeEthPkt (p=0x40048098, pkthdr=0x40581e50, pkt=0x40048080 "<{\203+") at decode.c:62
#3 0x15190 in ProcessPacket (user=0x400480a6 "E", pkthdr=0x63c, pkt=0x7f7f10d8 "@\004\200\200@\004\200\230") at snort.c:486
#4 0x50fc0 in RebuildFrag (ft=0x8c, p=0x400480a6) at spp_frag2.c:751
#5 0x508e8 in Frag2Defrag (p=0x7f7f0a98) at spp_frag2.c:473
#6 0x23770 in Preprocess (p=0x7f7f0a98) at rules.c:3508
#7 0x151c8 in ProcessPacket (user=0x400480a6 "E", pkthdr=0x63c, pkt=0x7f7f10d8 "@\004\200\200@\004\200\230") at snort.c:536
#8 0xc0a54ed4 in ?? () from /opt/libpcap/lib/libpcap.sl
#9 0xc0a55d68 in ?? () from /opt/libpcap/lib/libpcap.sl
#10 0x16ef0 in InterfaceThread (arg=0x400480a6) at snort.c:1663
#11 0x14d4c in main (argc=130, argv=0x7f7f075c) at snort.c:469
Be Teachable
1 REPLY 1
HPP
Regular Advisor

Re: can anyone tell what this mean from output of gdb?

Hi,
when i put this question to snort mailing list i got this answer:
+++++++++++++++++++++++++++++
Ok, one thing that is a portability problem for snort, as I understand
it, is in several places we have a struct that is looking at some
contiguous memory block.

Some of the fields in IP are 4bits wide and so when we access them, we
want the compiler to help us out and only give us the 4 bits we want.

Well, in this case, we want the value of 4 to be assigned into the
high order bits of a u_int8_t and since HP's processor doesn't wanna
do a write to anything smaller than a full sized character, we're out
in the water.

Realistically, tracking down all these in snort will require a
methodology and hopefully someone that is capable in C & has access to
an HP to test on.

If its only happening on the assignments/accesses that are less than
1 byte in size, we can probably find those but the int assignments
that are off boundary and whatnot are very difficult to find.
+++++++++++++++++++++++++

Basically i am not a programmer. I am doing trial and error by compiling with diff ver of GCC, snort, etc. I am running on HP-UX 11.00, GCC 3.0.1.

Can anyone help with this.
Thanks
Be Teachable