<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="" dir="auto"><div class="">Oddly, I’ve built in Physical host A and then running in another host B, it crashed when runs in host B, Any body know whats </div><div class=""><br class=""></div><div class=""><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">[Thread debugging using libthread_db enabled]</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">Using host libthread_db library "/lib64/libthread_db.so.1".</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">Core was generated by `./suricata -c /etc/suricata/suricata.yaml -i eth0'.</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">Program terminated with signal 4, Illegal instruction.</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">#0 0x00000000004500d6 in HTPRegisterPatternsForProtocolDetection () at app-layer-htp.c:2741</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">2741<span class="Apple-tab-span" style="white-space:pre"> </span>app-layer-htp.c: No such file or directory.</span></div></div><div class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><br class=""></span></div><div class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><br class=""></span></div><div class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><object apple-inline="yes" id="F7EB26A1-FEDD-4365-9411-E28F322D085A" height="192" width="675" apple-width="yes" apple-height="yes" class="" data="cid:F13D187F-2466-4E10-B9A5-2D2BA4854848@lan" type="application/x-apple-msg-attachment"></object></span></div><div class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><br class=""></span></div><div class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><br class=""></span></div><div class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">[root@ ~]# ./suricata --build-info</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">This is Suricata version 3.2dev</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">Features: PCAP_SET_BUFF LIBPCAP_VERSION_MAJOR=1 AF_PACKET HAVE_PACKET_FANOUT LIBCAP_NG HAVE_HTP_URI_NORMALIZE_HOOK PCRE_JIT HAVE_NSS HAVE_LUA HAVE_LIBJANSSON TLS MAGIC </span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">SIMD support: none</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">Atomic intrisics: 1 2 4 8 byte(s)</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">64-bits, Little-endian architecture</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">GCC version 4.8.5 20150623 (Red Hat 4.8.5-11), C version 199901</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">compiled with _FORTIFY_SOURCE=0</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">L1 cache line size (CLS)=64</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">thread local storage method: __thread</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">compiled with LibHTP v0.5.23, linked against LibHTP v0.5.23</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54); min-height: 15px;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""></span><br class=""></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">Suricata Configuration:</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> AF_PACKET support: yes</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> PF_RING support: no</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> NFQueue support: no</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> NFLOG support: no</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> IPFW support: no</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> Netmap support: no</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> DAG enabled: no</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> Napatech enabled: no</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54); min-height: 15px;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""></span><br class=""></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> Unix socket enabled: yes</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> Detection enabled: yes</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54); min-height: 15px;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""></span><br class=""></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> Libmagic support: yes</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> libnss support: yes</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> libnspr support: yes</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> libjansson support: yes</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> hiredis support: yes</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> Prelude support: no</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> PCRE jit: yes</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> LUA support: yes</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> libluajit: no</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> libgeoip: no</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> Non-bundled htp: yes</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> Old barnyard2 support: no</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> CUDA enabled: no</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> Hyperscan support: yes</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> Libnet support: no</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54); min-height: 15px;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""></span><br class=""></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> Suricatasc install: yes</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54); min-height: 15px;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""></span><br class=""></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> Profiling enabled: no</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> Profiling locks enabled: no</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54); min-height: 15px;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""></span><br class=""></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">Development settings:</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> Coccinelle / spatch: no</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> Unit tests enabled: no</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> Debug output enabled: no</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> Debug validation enabled: no</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54); min-height: 15px;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""></span><br class=""></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">Generic build parameters:</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> Installation prefix: /usr/local/</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> Configuration directory: /usr/local/etc/suricata/</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> Log directory: /usr/local/var/log/suricata/</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54); min-height: 15px;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""></span><br class=""></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> --prefix /usr/local/</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> --sysconfdir /usr/local/etc</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> --localstatedir /usr/local/var</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54); min-height: 15px;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""></span><br class=""></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> Host: x86_64-unknown-linux-gnu</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> Compiler: gcc (exec name) / gcc (real)</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> GCC Protect enabled: no</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> GCC march native enabled: no</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> GCC Profile enabled: no</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> Position Independent Executable enabled: no</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> CFLAGS -g -O2</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> PCAP_CFLAGS -I/usr/local/deps/include</span></div><div style="margin: 0px; font-size: 13px; line-height: normal; font-family: Menlo; color: rgb(131, 148, 150); background-color: rgb(1, 43, 54);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> SECCFLAGS </span></div><div class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><br class=""></span></div><div class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><br class=""></span></div></span></div><div class=""><span style="font-variant-ligatures: no-common-ligatures" class="">Thanks,</span></div><div class="">-Tidy</div><br class=""><div><blockquote type="cite" class=""><div class="">On Apr 22, 2017, at 6:27 AM, Tom DeCanio <<a href="mailto:decanio.tom@gmail.com" class="">decanio.tom@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><p dir="ltr" style="font-family: Times-Roman; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">I've seen illegal instruction crashes in the pcre library on some VMs. This sounds similar to your description.</p><br class="Apple-interchange-newline"></div></blockquote></div><br class=""></body></html>