<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div>Hi, </div><div><br></div><div>I've been testing with suricata on a VM environment to test if I can use it in a production environment. While testing the IPS features I can repeatedly crash suricata with a core dump by running the following command: </div><div><br></div><div><pre>nmap -Pn -sS -A -f 192.168.100.35</pre><div><br></div></div><div>Below the error message and the build-info. If you need more info please let me know and I will provide it. </div><div><br></div><div>Kind regards, </div><div><br></div><div>Rogier</div><div><br></div><div><br></div><div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Jun 13 23:41:37 ids kernel: Detect6[10431]: segfault at e ip 00000000004c6c97 sp 00007f29c75fd3e0 error 4 in suricata[400000+1d3000]</div></div><div style="margin: 0px; font-size: 11px; font-family: Menlo;"><br></div><div style="margin: 0px; font-size: 11px; font-family: Menlo;"><div style="margin: 0px;">[root@ids rules]# suricata --build-info</div><div style="margin: 0px;">This is Suricata version 2.0.1 RELEASE</div><div style="margin: 0px;">Features: NFQ PCAP_SET_BUFF LIBPCAP_VERSION_MAJOR=1 AF_PACKET HAVE_PACKET_FANOUT LIBCAP_NG LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK HAVE_NSS HAVE_LIBJANSSON PROFILING </div><div style="margin: 0px;">SIMD support: SSE_3 </div><div style="margin: 0px;">Atomic intrisics: 1 2 4 8 16 byte(s)</div><div style="margin: 0px;">64-bits, Little-endian architecture</div><div style="margin: 0px;">GCC version 4.4.7 20120313 (Red Hat 4.4.7-4), C version 199901</div><div style="margin: 0px;">L1 cache line size (CLS)=64</div><div style="margin: 0px;">compiled with LibHTP v0.5.11, linked against LibHTP v0.5.11</div><div style="margin: 0px;">Suricata Configuration:</div><div style="margin: 0px;"> AF_PACKET support: yes</div><div style="margin: 0px;"> PF_RING support: no</div><div style="margin: 0px;"> NFQueue support: yes</div><div style="margin: 0px;"> IPFW support: no</div><div style="margin: 0px;"> DAG enabled: no</div><div style="margin: 0px;"> Napatech enabled: no</div><div style="margin: 0px;"> Unix socket enabled: yes</div><div style="margin: 0px;"> Detection enabled: yes</div><div style="margin: 0px; min-height: 13px;"><br></div><div style="margin: 0px;"> libnss support: yes</div><div style="margin: 0px;"> libnspr support: yes</div><div style="margin: 0px;"> libjansson support: yes</div><div style="margin: 0px;"> Prelude support: no</div><div style="margin: 0px;"> PCRE jit: no</div><div style="margin: 0px;"> libluajit: no</div><div style="margin: 0px;"> libgeoip: yes</div><div style="margin: 0px;"> Non-bundled htp: no</div><div style="margin: 0px;"> Old barnyard2 support: no</div><div style="margin: 0px;"> CUDA enabled: no</div><div style="margin: 0px; min-height: 13px;"><br></div><div style="margin: 0px;"> Suricatasc install: yes</div><div style="margin: 0px; min-height: 13px;"><br></div><div style="margin: 0px;"> Unit tests enabled: no</div><div style="margin: 0px;"> Debug output enabled: no</div><div style="margin: 0px;"> Debug validation enabled: no</div><div style="margin: 0px;"> Profiling enabled: yes</div><div style="margin: 0px;"> Profiling locks enabled: no</div><div style="margin: 0px;"> Coccinelle / spatch: no</div><div style="margin: 0px; min-height: 13px;"><br></div><div style="margin: 0px;">Generic build parameters:</div><div style="margin: 0px;"> Installation prefix (--prefix): /usr</div><div style="margin: 0px;"> Configuration directory (--sysconfdir): /etc/suricata/</div><div style="margin: 0px;"> Log directory (--localstatedir) : /var/log/suricata/</div><div style="margin: 0px; min-height: 13px;"><br></div><div style="margin: 0px;"> Host: x86_64-unknown-linux-gnu</div><div style="margin: 0px;"> GCC binary: gcc</div><div style="margin: 0px;"> GCC Protect enabled: no</div><div style="margin: 0px;"> GCC march native enabled: yes</div><div style="margin: 0px;"> GCC Profile enabled: no</div><div style="margin: 0px;">[root@ids rules]# </div><div><br></div><div><br></div><div><br></div></div></body></html>