Stefan thank you for your help.<br>Would you please post a bug for this<br><a href="https://redmine.openinfosecfoundation.org/projects/suricata/issues">https://redmine.openinfosecfoundation.org/projects/suricata/issues</a><br>
<br>with a good explanation.<br><br>thank you<br><br><br><div class="gmail_quote">On Tue, Jun 19, 2012 at 10:55 AM, Stefan Sabolowitsch <span dir="ltr"><<a href="mailto:Stefan.Sabolowitsch@felten-group.com" target="_blank">Stefan.Sabolowitsch@felten-group.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word">
Hi Peter,
<div>
<div dir="ltr">
<div><font lang="en">It's definitely this commit "</font><span style="font-family:'Lucida Grande';font-size:12px">bd3a655aeb8975ae8c51a02213d40bf21047f5e9"</span> with pcap changes.</div>
<div>With this pcap changes i get directly a segfault.</div>
<div><font lang="en">I have tested all commits from beta2 to this problem commit.</font></div>
</div>
<div><br>
</div>
<div>Stefan</div>
<br>
<div>
<div>Am 19.06.2012 um 09:48 schrieb Peter Manev:</div><div><div class="h5">
<br>
<blockquote type="cite">here is some good info for the git commands:<br>
<a href="http://www.siteground.com/tutorials/git/commands.htm" target="_blank">http://www.siteground.com/tutorials/git/commands.htm</a><br>
<br>
but you would need "git log" and "git checkout" mostly , after you have done the
<br>
"git clone git://<a href="http://phalanx.openinfosecfoundation.org/oisf.git" target="_blank">phalanx.openinfosecfoundation.org/oisf.git</a>"<br>
<br>
This could be long and tenacious, but thank you very much for your efforts!!<br>
<br>
<br>
<div class="gmail_quote">On Tue, Jun 19, 2012 at 9:42 AM, Stefan Sabolowitsch <span dir="ltr">
<<a href="mailto:Stefan.Sabolowitsch@felten-group.com" target="_blank">Stefan.Sabolowitsch@felten-group.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word">no Peter...
<div>
<div><font lang="en">but i can test the individual branches, master, updates.</font></div>
<div><font lang="en">May we find the errors faster.</font></div>
<div><font lang="en">How i do that with git?</font></div>
<div><br>
</div>
<div><br>
</div>
<br>
<div>
<div>Am 19.06.2012 um 09:33 schrieb Peter Manev:</div>
<div>
<div><br>
<blockquote type="cite">are you using Napatech or Myricom?<br>
<br>
<div class="gmail_quote">On Tue, Jun 19, 2012 at 9:24 AM, Stefan Sabolowitsch <span dir="ltr">
<<a href="mailto:Stefan.Sabolowitsch@felten-group.com" target="_blank">Stefan.Sabolowitsch@felten-group.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word">
<div>Hi Peter,</div>
<div>
<div dir="ltr">
<div><font lang="en">I had no problem before version beta2, this machine run more with 3 months without any problem.</font></div>
<div><font lang="en">I think the problems have started from the 11.06.12</font></div>
</div>
</div>
<div><br>
</div>
<div><font lang="en">Maybe this is the problem:</font></div>
<div>suricata-1.3beta2-11-g988c92f </div>
<pre><font face="Helvetica">- Log -----------------------------------------------------------------
commit bd3a655aeb8975ae8c51a02213d40bf21047f5e9
Author: Victor Julien <victor at <a href="http://inliniac.net/" target="_blank">inliniac.net</a>>
Date: Sun May 20 12:12:42 2012 +0200
Add pcap workers mode.
Some cards like Napatech or Myricom support libpcap wrappers that allow for
multiple streams, queues, ringbuffers. The workers mode can be of use in
those cases.
-----------------------------------------------------------------------
Summary of changes:
src/runmode-pcap.c | 81 ++++++++++++++++++++++++++++++++++++++++++++++++----
src/source-pcap.h | 2 +
2 files changed, 77 insertions(+), 6 deletions(-)</font>
</pre>
<div><br>
</div>
<div>thx</div>
<div>Stefan</div>
<br>
<div>
<div>Am 19.06.2012 um 09:09 schrieb Peter Manev:</div>
<div>
<div><br>
<blockquote type="cite">Hi Stefan,<br>
<br>
so this problem is only on beta1? , you never have had that problem with beta2? correct?<br>
<br>
thanks<br>
<br>
<div class="gmail_quote">On Tue, Jun 19, 2012 at 9:06 AM, Stefan Sabolowitsch <span dir="ltr">
<<a href="mailto:Stefan.Sabolowitsch@felten-group.com" target="_blank">Stefan.Sabolowitsch@felten-group.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word">Hi all,
<div>any news here ? you need any information or help from my (debug etc.) ?</div>
<div>Actually i run without any problem on beta2.</div>
<div><br>
</div>
<div>thx</div>
<div>Stefan</div>
<div><br>
<div>
<div>Am 16.06.2012 um 18:21 schrieb Eric Leblond:</div>
<div>
<div><br>
<blockquote type="cite">Oups. I forgot one step. After getting gdb shell. Use the run command (without any arguments)<br>
<br>
BR.<br>
<br>
Stefan Sabolowitsch <<a href="mailto:Stefan.Sabolowitsch@felten-group.com" target="_blank">Stefan.Sabolowitsch@felten-group.com</a>> a écrit :<br>
<br>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d" lang="EN-US">Hmmm, sorry Eric but I need a little more help.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d" lang="EN-US"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d" lang="EN-US">When I take this here:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d" lang="EN-US"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d" lang="EN-US">[root@ipd1 bin]# gdb --args ./suricata --user sguil --group sguil -c /etc/nsm/Serrig-intern/suricata.yaml -F /etc/nsm/Serrig-intern/bpf.filt -i
br0 -l /nsm/sensor_data/Serrig-intern<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d" lang="EN-US">GNU gdb (GDB) Red Hat Enterprise Linux (7.2-50.el6)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d" lang="EN-US">Copyright (C) 2010 Free Software Foundation, Inc.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d" lang="EN-US">License GPLv3+: GNU GPL version 3 or later <<a href="http://gnu.org/licenses/gpl.html" target="_blank">http://gnu.org/licenses/gpl.html</a>><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d" lang="EN-US">This is free software: you are free to change and redistribute it.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d" lang="EN-US">There is NO WARRANTY, to the extent permitted by law. Type "show copying"<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d" lang="EN-US">and "show warranty" for details.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d" lang="EN-US">This GDB was configured as "x86_64-redhat-linux-gnu".<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d" lang="EN-US">For bug reporting instructions, please see:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d" lang="EN-US"><<a href="http://www.gnu.org/software/gdb/bugs/" target="_blank">http://www.gnu.org/software/gdb/bugs/</a>>...<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d" lang="EN-US">Reading symbols from /usr/local/bin/suricata...done.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d" lang="EN-US">(gdb)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d" lang="EN-US"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d" lang="EN-US">But nothing chrashes<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d" lang="EN-US"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d" lang="EN-US">When i take this cmdline without “gdb –args”, suricata crashes directly.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d" lang="EN-US">What do I wrong here with gdb ??
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d" lang="EN-US"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">Von:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Eric Leblond [mailto:<a href="mailto:eric@regit.org" target="_blank">eric@regit.org</a>]
<br>
<b>Gesendet:</b> Samstag, 16. Juni 2012 17:42<br>
<b>An:</b> Stefan Sabolowitsch<br>
<b>Cc:</b> Peter Manev; oisf<br>
<b>Betreff:</b> Re: [Oisf-users] segfault with latest suricata version (rev 988c92f) 1.3x<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal" style="margin-bottom:12.0pt">hello<br>
<br>
Can you run it in gdb qnd send us a backtrace.<br>
You can do it by running<br>
gdb --args mysuricatacmdline<br>
Then when it crashes do<br>
bt<br>
And send us the result.<br>
<br>
BR<br>
<br>
Stefan Sabolowitsch <<a href="mailto:Stefan.Sabolowitsch@felten-group.com" target="_blank">Stefan.Sabolowitsch@felten-group.com</a>> a écrit :<u></u><u></u></p>
<div>
<p><span lang="EN-US">Hi Peter, thanks for your fast answer.</span><u></u><u></u></p>
<p><span lang="EN-US">I use the “-i” parameter for the interface, look here:</span><u></u><u></u></p>
<p><span lang="EN-US">Executing: suricata --user sguil --group sguil -c /etc/nsm/Serrig-intern/suricata.yaml -F /etc/nsm/Serrig-intern/bpf.filt -i br0 -l /nsm/sensor_data/Serrig-intern</span><u></u><u></u></p>
<p><span lang="EN-US">Executing: suricata --user sguil --group sguil -c /etc/nsm/Serrig-DMZ/suricata.yaml -F /etc/nsm/Serrig-DMZ/bpf.filt -i br1 -l /nsm/sensor_data/Serrig-DMZ</span><u></u><u></u></p>
<p><span lang="EN-US"> </span><u></u><u></u></p>
<p><span lang="EN-US">And i compile with this parameter (Centos 6.0 64bit)</span><u></u><u></u></p>
<p><span lang="EN-US">./autogen.sh</span><u></u><u></u></p>
<p><span lang="EN-US">./configure --enable-pcre-jit</span><u></u><u></u></p>
<p><span lang="EN-US"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"" lang="EN">Version 1.3beta worked for two months without any problem, also version beta2. But then the problems started.</span><u></u><u></u></p>
<p><span lang="EN-US"> </span><u></u><u></u></p>
<p><span lang="EN-US">My last test…</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"" lang="EN-US">Jun 16 17:14:46 ipd1 kernel: device br0 entered promiscuous mode</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"" lang="EN-US">Jun 16 17:14:46 ipd1 sancp: started normally</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"" lang="EN-US">Jun 16 17:14:53 ipd1 sancp: Retrieved last connection ID: 5754608452622280998 8 0</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"" lang="EN-US">Jun 16 17:14:53 ipd1 kernel: device br1 entered promiscuous mode</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"" lang="EN-US">Jun 16 17:14:53 ipd1 sancp: started normally</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"" lang="EN-US">Jun 16 17:14:59 ipd1 kernel: RxPcapbr034[14337]: segfault at 21 ip 0000000000000021 sp 00007fb5e75fcce8 error 14</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"" lang="EN-US">Jun 16 17:14:59 ipd1 kernel: RxPcapbr038[14341]: segfault at 21 ip 0000000000000021 sp 00007fb5e4df8ce8 error 14 in suricata[400000+179000]</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"">Jun 16 17:14:59 ipd1 kernel: in suricata[400000+179000]</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"" lang="EN-US">Jun 16 17:14:59 ipd1 kernel: RxPcapbr027[14330]: segfault at 21 ip 0000000000000021 sp 00007fb6275fcce8 error 14</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"" lang="EN-US">Jun 16 17:14:59 ipd1 kernel: RxPcapbr025[14328]: segfault at 21 ip 0000000000000021 sp 00007fb62cdf8ce8 error 14</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"" lang="EN-US">Jun 16 17:14:59 ipd1 kernel: RxPcapbr029[14332]: segfault at 21 ip 0000000000000021 sp 00007fb6261face8 error 14</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"" lang="EN-US">Jun 16 17:14:59 ipd1 kernel: RxPcapbr031[14334]: segfault at 21 ip 0000000000000021 sp 00007fb61d71ece8 error 14 in suricata[400000+179000]</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"" lang="EN-US">Jun 16 17:14:59 ipd1 kernel: RxPcapbr010[14313]: segfault at 21 ip 0000000000000021 sp 00007fb63e8dfce8 error 14 in suricata[400000+179000]</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"">Jun 16 17:14:59 ipd1 kernel: in suricata[400000+179000]</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"">Jun 16 17:14:59 ipd1 kernel: in suricata[400000+179000]</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"">Jun 16 17:14:59 ipd1 kernel: in suricata[400000+179000]</span><u></u><u></u></p>
<p> <u></u><u></u></p>
<p> <u></u><u></u></p>
<p> <u></u><u></u></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">Von:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Peter Manev
<a href="mailto:[mailto:petermanev@gmail.com]" target="_blank">[mailto:petermanev@gmail.com]</a>
<br>
<b>Gesendet:</b> Samstag, 16. Juni 2012 15:46<br>
<b>An:</b> Stefan Sabolowitsch<br>
<b>Cc:</b> <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">
oisf-users@openinfosecfoundation.org</a><br>
<b>Betreff:</b> Re: [Oisf-users] segfault with latest suricata version (rev 988c92f) 1.3x</span><u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal" style="margin-bottom:12.0pt">Hi Stefan,<br>
Have you specified "<span lang="EN-US"> interface br0</span>" in the yaml conf file:<u></u><u></u></p>
<p class="MsoNormal">pcap:<br>
<b>- interface: br0</b><br>
#buffer-size: 32768<br>
#bpf-filter: "tcp and port 25"<br>
# Choose checksum verification mode for the interface. At the moment<br>
# of the capture, some packets may be with an invalid checksum due to<br>
# offloading to the network card of the checksum com<u></u><u></u></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
How did you compile Suricata?<br>
<br>
Thanks<u></u><u></u></p>
<div>
<p class="MsoNormal">On Sat, Jun 16, 2012 at 2:13 PM, Stefan Sabolowitsch <<a href="mailto:Stefan.Sabolowitsch@felten-group.com" target="_blank">Stefan.Sabolowitsch@felten-group.com</a>> wrote:<u></u><u></u></p>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">Hi all,</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">i have with the latest suricata Version (rev 988c92f) a segfault, never seen before “beta2”.
</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">Any help ?</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">Thx</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">Stefan</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">-#-#-#- snipp #-#-#-#-#</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"" lang="EN-US">Jun 16 13:55:49 ipd1 kernel: device br0 left promiscuous mode</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"" lang="EN-US">Jun 16 13:55:49 ipd1 kernel: device br1 left promiscuous mode</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"" lang="EN-US">Jun 16 13:55:49 ipd1 sancp: Exiting</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"" lang="EN-US">Jun 16 13:55:50 ipd1 sancp: Exiting</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"" lang="EN-US">Jun 16 13:56:41 ipd1 sancp: Retrieved last connection ID: 5754602263574629554 8 0</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"" lang="EN-US">Jun 16 13:56:41 ipd1 kernel: device br0 entered promiscuous mode</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"" lang="EN-US">Jun 16 13:56:41 ipd1 sancp: started normally</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"" lang="EN-US">Jun 16 13:56:53 ipd1 kernel: RxPcapbr010[10498]: segfault at 21 ip 0000000000000021 sp 00007ff755148ce8 error 14</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"" lang="EN-US">Jun 16 13:56:53 ipd1 kernel: RxPcapbr05[10493]: segfault at 21 ip 0000000000000021 sp 00007ff75a23bce8 error 14 in suricata[400000+179000]</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"">Jun 16 13:56:53 ipd1 kernel: in suricata[400000+179000]</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"" lang="EN-US">Jun 16 13:56:53 ipd1 kernel: RxPcapbr06[10494]: segfault at 21 ip 0000000000000021 sp 00007ff75983ace8 error 14 in suricata[400000+179000]</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"" lang="EN-US">Jun 16 13:56:58 ipd1 sancp: Retrieved last connection ID: 5754602263574929436 8 0</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"" lang="EN-US">Jun 16 13:56:58 ipd1 kernel: device br1 entered promiscuous mode</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"" lang="EN-US">Jun 16 13:56:58 ipd1 sancp: started normally</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">-#-#-#-#-snapp-+-+-+-+-+-</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">And I found this in the logfile:</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10493] 16/6/2012 -- 13:56:52 - (source-pcap.c:353) <Info> (ReceivePcapThreadInit) -- using interface br0</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10493] 16/6/2012 -- 13:56:52 - (source-pcap.c:358) <Info> (ReceivePcapThreadInit) -- Running in 'auto' checksum mode. Detection of interface state will require 1000 packets.</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10489] 16/6/2012 -- 13:56:52 - (source-pcap.c:353) <Info> (ReceivePcapThreadInit) -- using interface br0</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10489] 16/6/2012 -- 13:56:52 - (source-pcap.c:358) <Info> (ReceivePcapThreadInit) -- Running in 'auto' checksum mode. Detection of interface state will require 1000 packets.</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10492] 16/6/2012 -- 13:56:52 - (source-pcap.c:353) <Info> (ReceivePcapThreadInit) -- using interface br0</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10491] 16/6/2012 -- 13:56:52 - (source-pcap.c:353) <Info> (ReceivePcapThreadInit) -- using interface br0</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10494] 16/6/2012 -- 13:56:52 - (source-pcap.c:353) <Info> (ReceivePcapThreadInit) -- using interface br0</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10491] 16/6/2012 -- 13:56:52 - (source-pcap.c:358) <Info> (ReceivePcapThreadInit) -- Running in 'auto' checksum mode. Detection of interface state will require 1000 packets.</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10494] 16/6/2012 -- 13:56:52 - (source-pcap.c:358) <Info> (ReceivePcapThreadInit) -- Running in 'auto' checksum mode. Detection of interface state will require 1000 packets.</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10490] 16/6/2012 -- 13:56:52 - (source-pcap.c:353) <Info> (ReceivePcapThreadInit) -- using interface br0</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10492] 16/6/2012 -- 13:56:52 - (source-pcap.c:358) <Info> (ReceivePcapThreadInit) -- Running in 'auto' checksum mode. Detection of interface state will require 1000 packets.</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10495] 16/6/2012 -- 13:56:52 - (source-pcap.c:353) <Info> (ReceivePcapThreadInit) -- using interface br0</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10495] 16/6/2012 -- 13:56:52 - (source-pcap.c:358) <Info> (ReceivePcapThreadInit) -- Running in 'auto' checksum mode. Detection of interface state will require 1000 packets.</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10490] 16/6/2012 -- 13:56:52 - (source-pcap.c:358) <Info> (ReceivePcapThreadInit) -- Running in 'auto' checksum mode. Detection of interface state will require 1000 packets.</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10496] 16/6/2012 -- 13:56:52 - (source-pcap.c:353) <Info> (ReceivePcapThreadInit) -- using interface br0</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10496] 16/6/2012 -- 13:56:52 - (source-pcap.c:358) <Info> (ReceivePcapThreadInit) -- Running in 'auto' checksum mode. Detection of interface state will require 1000 packets.</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10498] 16/6/2012 -- 13:56:52 - (source-pcap.c:353) <Info> (ReceivePcapThreadInit) -- using interface br0</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10498] 16/6/2012 -- 13:56:52 - (source-pcap.c:358) <Info> (ReceivePcapThreadInit) -- Running in 'auto' checksum mode. Detection of interface state will require 1000 packets.</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10501] 16/6/2012 -- 13:56:52 - (source-pcap.c:353) <Info> (ReceivePcapThreadInit) -- using interface br0</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10501] 16/6/2012 -- 13:56:52 - (source-pcap.c:358) <Info> (ReceivePcapThreadInit) -- Running in 'auto' checksum mode. Detection of interface state will require 1000 packets.</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10499] 16/6/2012 -- 13:56:52 - (source-pcap.c:353) <Info> (ReceivePcapThreadInit) -- using interface br0</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10499] 16/6/2012 -- 13:56:52 - (source-pcap.c:358) <Info> (ReceivePcapThreadInit) -- Running in 'auto' checksum mode. Detection of interface state will require 1000 packets.</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10500] 16/6/2012 -- 13:56:52 - (source-pcap.c:353) <Info> (ReceivePcapThreadInit) -- using interface br0</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10500] 16/6/2012 -- 13:56:52 - (source-pcap.c:358) <Info> (ReceivePcapThreadInit) -- Running in 'auto' checksum mode. Detection of interface state will require 1000 packets.</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10497] 16/6/2012 -- 13:56:52 - (source-pcap.c:353) <Info> (ReceivePcapThreadInit) -- using interface br0</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10502] 16/6/2012 -- 13:56:52 - (source-pcap.c:353) <Info> (ReceivePcapThreadInit) -- using interface br0</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10497] 16/6/2012 -- 13:56:52 - (source-pcap.c:358) <Info> (ReceivePcapThreadInit) -- Running in 'auto' checksum mode. Detection of interface state will require 1000 packets.</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10502] 16/6/2012 -- 13:56:52 - (source-pcap.c:358) <Info> (ReceivePcapThreadInit) -- Running in 'auto' checksum mode. Detection of interface state will require 1000 packets.</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10503] 16/6/2012 -- 13:56:52 - (source-pcap.c:353) <Info> (ReceivePcapThreadInit) -- using interface br0</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10503] 16/6/2012 -- 13:56:52 - (source-pcap.c:358) <Info> (ReceivePcapThreadInit) -- Running in 'auto' checksum mode. Detection of interface state will require 1000 packets.</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10505] 16/6/2012 -- 13:56:52 - (source-pcap.c:353) <Info> (ReceivePcapThreadInit) -- using interface br0</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10505] 16/6/2012 -- 13:56:52 - (source-pcap.c:358) <Info> (ReceivePcapThreadInit) -- Running in 'auto' checksum mode. Detection of interface state will require 1000 packets.</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10504] 16/6/2012 -- 13:56:52 - (source-pcap.c:353) <Info> (ReceivePcapThreadInit) -- using interface br0</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10504] 16/6/2012 -- 13:56:52 - (source-pcap.c:358) <Info> (ReceivePcapThreadInit) -- Running in 'auto' checksum mode. Detection of interface state will require 1000 packets.</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10507] 16/6/2012 -- 13:56:52 - (source-pcap.c:353) <Info> (ReceivePcapThreadInit) -- using interface br0</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10507] 16/6/2012 -- 13:56:52 - (source-pcap.c:358) <Info> (ReceivePcapThreadInit) -- Running in 'auto' checksum mode. Detection of interface state will require 1000 packets.</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10506] 16/6/2012 -- 13:56:52 - (source-pcap.c:353) <Info> (ReceivePcapThreadInit) -- using interface br0</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10506] 16/6/2012 -- 13:56:52 - (source-pcap.c:358) <Info> (ReceivePcapThreadInit) -- Running in 'auto' checksum mode. Detection of interface state will require 1000 packets.</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10509] 16/6/2012 -- 13:56:52 - (source-pcap.c:353) <Info> (ReceivePcapThreadInit) -- using interface br0</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10509] 16/6/2012 -- 13:56:52 - (source-pcap.c:358) <Info> (ReceivePcapThreadInit) -- Running in 'auto' checksum mode. Detection of interface state will require 1000 packets.</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10508] 16/6/2012 -- 13:56:52 - (source-pcap.c:353) <Info> (ReceivePcapThreadInit) -- using interface br0</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10508] 16/6/2012 -- 13:56:52 - (source-pcap.c:358) <Info> (ReceivePcapThreadInit) -- Running in 'auto' checksum mode. Detection of interface state will require 1000 packets.</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10510] 16/6/2012 -- 13:56:52 - (source-pcap.c:353) <Info> (ReceivePcapThreadInit) -- using interface br0</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10510] 16/6/2012 -- 13:56:52 - (source-pcap.c:358) <Info> (ReceivePcapThreadInit) -- Running in 'auto' checksum mode. Detection of interface state will require 1000 packets.</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10511] 16/6/2012 -- 13:56:52 - (source-pcap.c:353) <Info> (ReceivePcapThreadInit) -- using interface br0</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10511] 16/6/2012 -- 13:56:52 - (source-pcap.c:358) <Info> (ReceivePcapThreadInit) -- Running in 'auto' checksum mode. Detection of interface state will require 1000 packets.</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10512] 16/6/2012 -- 13:56:52 - (source-pcap.c:353) <Info> (ReceivePcapThreadInit) -- using interface br0</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10512] 16/6/2012 -- 13:56:52 - (source-pcap.c:358) <Info> (ReceivePcapThreadInit) -- Running in 'auto' checksum mode. Detection of interface state will require 1000 packets.</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10513] 16/6/2012 -- 13:56:52 - (source-pcap.c:353) <Info> (ReceivePcapThreadInit) -- using interface br0</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10513] 16/6/2012 -- 13:56:52 - (source-pcap.c:358) <Info> (ReceivePcapThreadInit) -- Running in 'auto' checksum mode. Detection of interface state will require 1000 packets.</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10514] 16/6/2012 -- 13:56:53 - (source-pcap.c:353) <Info> (ReceivePcapThreadInit) -- using interface br0</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10514] 16/6/2012 -- 13:56:53 - (source-pcap.c:358) <Info> (ReceivePcapThreadInit) -- Running in 'auto' checksum mode. Detection of interface state will require 1000 packets.</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10515] 16/6/2012 -- 13:56:53 - (source-pcap.c:353) <Info> (ReceivePcapThreadInit) -- using interface br0</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10516] 16/6/2012 -- 13:56:53 - (source-pcap.c:353) <Info> (ReceivePcapThreadInit) -- using interface br0</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10515] 16/6/2012 -- 13:56:53 - (source-pcap.c:358) <Info> (ReceivePcapThreadInit) -- Running in 'auto' checksum mode. Detection of interface state will require 1000 packets.</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10516] 16/6/2012 -- 13:56:53 - (source-pcap.c:358) <Info> (ReceivePcapThreadInit) -- Running in 'auto' checksum mode. Detection of interface state will require 1000 packets.</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10517] 16/6/2012 -- 13:56:53 - (source-pcap.c:348) <Error> (ReceivePcapThreadInit) -- [ERRCODE: SC_ERR_INVALID_VALUE(129)] - Unable to find Live device</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10518] 16/6/2012 -- 13:56:53 - (source-pcap.c:348) <Error> (ReceivePcapThreadInit) -- [ERRCODE: SC_ERR_INVALID_VALUE(129)] - Unable to find Live device</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10520] 16/6/2012 -- 13:56:53 - (source-pcap.c:348) <Error> (ReceivePcapThreadInit) -- [ERRCODE: SC_ERR_INVALID_VALUE(129)] - Unable to find Live device</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">[10519] 16/6/2012 -- 13:56:53 - (source-pcap.c:348) <Error> (ReceivePcapThreadInit) -- [ERRCODE: SC_ERR_INVALID_VALUE(129)] - Unable to find Live device</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US"> </span><u></u><u></u></p>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
_______________________________________________<br>
Oisf-users mailing list<br>
<a href="mailto:Oisf-users@openinfosecfoundation.org" target="_blank">Oisf-users@openinfosecfoundation.org</a><br>
<a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><u></u><u></u></p>
</div>
<p class="MsoNormal"><br>
<br clear="all">
<br>
-- <u></u><u></u></p>
<div>
<p class="MsoNormal">Regards,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Peter Manev<u></u><u></u></p>
</div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
</div>
</blockquote>
</div>
</div>
</div>
<br>
</div>
</div>
</blockquote>
</div>
<br>
<br clear="all">
<br>
-- <br>
<div>Regards,</div>
<div>Peter Manev</div>
<br>
</blockquote>
</div>
</div>
</div>
<br>
</div>
</blockquote>
</div>
<br>
<br clear="all">
<br>
-- <br>
<div>Regards,</div>
<div>Peter Manev</div>
<br>
</blockquote>
</div>
</div>
</div>
<br>
</div>
</div>
</blockquote>
</div>
<br>
<br clear="all">
<br>
-- <br>
<div>Regards,</div>
<div>Peter Manev</div>
<br>
</blockquote>
</div></div></div>
<br>
</div>
</div>
</blockquote></div><br><br clear="all"><br>-- <br><div>Regards,</div>
<div>Peter Manev</div><br>