Snort: Bus Error (coredump)

[Bosco Tsang]

I am trying to run snort 1.8.6 (from HP ported software depot) on both HPUX11.00 and HPUX 11.11. But got the same error as above (see below for the command prompt output). However, snort has been running (same snort.conf) on Solaris and RH Linux without problem. I have attached the core file from 11.11. Just wondering what's wrong and how to fix it?

--
# ../bin/snort -c snort.conf
Log directory = /var/log/snort

Initializing Network Interface lan0

--== Initializing Snort ==--
Decoding Ethernet on interface lan0
Initializing Preprocessors!
Initializing Plug-ins!
Initializating Output Plugins!
Parsing Rules file snort.conf

+++++++++++++++++++++++++++++++++++++++++++++++++++
Initializing rule chains...
No arguments to frag2 directive, setting defaults to:
Fragment timeout: 60 seconds
Fragment memory cap: 4194304 bytes
Stream4 config:
Stateful inspection: ACTIVE
Session statistics: INACTIVE
Session timeout: 30 seconds
Session memory cap: 8388608 bytes
State alerts: INACTIVE
Scan alerts: ACTIVE
Log Flushed Streams: INACTIVE
Bus error(coredump)

[harry d brown jr]

Can you post your rules file?

live free or die
harry

[Bosco Tsang]

Which rules file are you looking for? the entire rules directory? or just snort.conf?

I have attached the core file one more time. If it's still not working, then I will have to email to you.

For both servers, it's been patched up to very recent release, for both golden base and HWE.

Thanks,
Bosco

[Eugeny Brychkov]

Attachment does not work :o(
Did you check if you installed latest Diags, GR and HWE patch bundles? Just an idea.
Eugeny

[harry d brown jr]

Bosco,

The core file attachment isn't working.

How about attaching the snort.conf file.

And I like the out of order posting that the itrc system did.

live free or die
harry