Hi,<br><br>It does look like something recently discovered but not confirmed yet, as of where/what exactly triggers it.<br>Do you have the same results if you run Suricata without --enable-profiling?<br><br>Thanks<br><br><div class="gmail_quote">
On Sat, Dec 17, 2011 at 9:41 PM, carlopmart <span dir="ltr"><<a href="mailto:carlopmart@gmail.com">carlopmart@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="HOEnZb"><div class="h5">On 12/16/2011 02:30 PM, carlopmart wrote:<br>
> Hi all,<br>
><br>
> After updating my suricata 1.1 to 1.1.1, I can see several errors from<br>
> http parser, like in this thread:<br>
><br>
> <a href="http://lists.openinfosecfoundation.org/pipermail/oisf-users/2011-December/001150.html" target="_blank">http://lists.openinfosecfoundation.org/pipermail/oisf-users/2011-December/001150.html</a><br>
><br>
><br>
> My errors:<br>
><br>
> [100066] 16/12/2011 -- 12:29:04 - (app-layer-htp.c:487) <Error><br>
> (HTPHandleResponseData) -- [ERRCODE: SC_ERR_ALPARSER(59)] - Error in<br>
> parsing HTTP server response: [1] [htp_response.c] [677] Unable to ma<br>
> tch response to request<br>
> [100066] 16/12/2011 -- 12:29:04 - (app-layer-parser.c:969) <Error><br>
> (AppLayerParse) -- [ERRCODE: SC_ERR_ALPARSER(59)] - Error occured in<br>
> parsing "http" app layer protocol, using network protocol 6, sourc<br>
> e IP address 172.25.50.25, destination IP address 85.214.82.144, src<br>
> port 35859 and dst port 80<br>
> [100066] 16/12/2011 -- 13:03:38 - (app-layer-htp.c:487) <Error><br>
> (HTPHandleResponseData) -- [ERRCODE: SC_ERR_ALPARSER(59)] - Error in<br>
> parsing HTTP server response: [1] [htp_response.c] [677] Unable to ma<br>
> tch response to request<br>
> [100066] 16/12/2011 -- 13:03:38 - (app-layer-parser.c:969) <Error><br>
> (AppLayerParse) -- [ERRCODE: SC_ERR_ALPARSER(59)] - Error occured in<br>
> parsing "http" app layer protocol, using network protocol 6, sourc<br>
> e IP address 172.25.50.25, destination IP address 85.214.82.144, src<br>
> port 55596 and dst port 80<br>
><br>
> I have compiled suricata with "--enable-profiling --enable-ipfw" flags<br>
> under FreeBSD 8.1 32bit host.<br>
><br>
> Is this a known bug in stable version??<br>
><br>
> Thanks.<br>
><br>
<br>
</div></div>Please, any help??<br>
<div class="HOEnZb"><div class="h5"><br>
<br>
--<br>
CL Martinez<br>
carlopmart {at} gmail {d0t} com<br>
_______________________________________________<br>
Oisf-users mailing list<br>
<a href="mailto:Oisf-users@openinfosecfoundation.org">Oisf-users@openinfosecfoundation.org</a><br>
<a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br>Peter Manev<br>