<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p style="margin-top:0;margin-bottom:0">This helped. Thank you.</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<br>
<br>
<div style="color: rgb(0, 0, 0);">
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Oisf-users <oisf-users-bounces@lists.openinfosecfoundation.org> on behalf of Victor Julien <lists@inliniac.net><br>
<b>Sent:</b> Friday, August 3, 2018 4:02 PM<br>
<b>To:</b> oisf-users@lists.openinfosecfoundation.org<br>
<b>Subject:</b> Re: [Oisf-users] Crash in 4.0.5 when receiving packets</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">Ubuntu had released a broken libjansson upgrade yesterday, but it should<br>
be fixed if you upgrade again to 2.5-2ubuntu0.2<br>
<br>
# dpkg --list libjansson*<br>
...<br>
ii libjansson4:i386 2.5-2ubuntu0.2<br>
i386 C library for encoding, decoding and<br>
manipulating JSON data<br>
<br>
<br>
Simply another apt update && apt upgrade should fix it.<br>
<br>
See: <a href="https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fredmine.openinfosecfoundation.org%2Fissues%2F2560&data=02%7C01%7C%7C28e2f7303c8040cc0bdf08d5f908164d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636688735480209165&sdata=wJRuwzksmujlWgpmG5ueHbKV1uqPPS%2BkJaAI%2FmU4EqQ%3D&reserved=0" id="LPlnk392774" previewremoved="true">
https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fredmine.openinfosecfoundation.org%2Fissues%2F2560&data=02%7C01%7C%7C28e2f7303c8040cc0bdf08d5f908164d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636688735480209165&sdata=wJRuwzksmujlWgpmG5ueHbKV1uqPPS%2BkJaAI%2FmU4EqQ%3D&reserved=0</a><br>
<br>
On 03-08-18 03:27, Peter Fyon wrote:<br>
> I'm on Ubuntu 14.04 in IPS mode using af_packet. <br>
> <br>
> On Thu, Aug 2, 2018, 9:04 PM Peter Manev <petermanev@gmail.com<br>
> <<a href="mailto:petermanev@gmail.com">mailto:petermanev@gmail.com</a>>> wrote:<br>
> <br>
> <br>
> <br>
> On 3 Aug 2018, at 01:26, Serge Malev <smalev@hotmail.com<br>
> <<a href="mailto:smalev@hotmail.com">mailto:smalev@hotmail.com</a>>> wrote:<br>
> <br>
>> I am having the same problem. Suricata tries to restart every 5<br>
>> minutes and crashes with the same error.<br>
>><br>
>><br>
> <br>
> Hi,<br>
> <br>
> Are you using IDS or IPS mode?<br>
> <br>
> Thank you<br>
> <br>
>><br>
>><br>
>><br>
>> ------------------------------------------------------------------------<br>
>> *From:* Oisf-users<br>
>> <oisf-users-bounces@lists.openinfosecfoundation.org<br>
>> <<a href="mailto:oisf-users-bounces@lists.openinfosecfoundation.org">mailto:oisf-users-bounces@lists.openinfosecfoundation.org</a>>> on<br>
>> behalf of Peter Fyon <peter.fyon@gmail.com<br>
>> <<a href="mailto:peter.fyon@gmail.com">mailto:peter.fyon@gmail.com</a>>><br>
>> *Sent:* Friday, August 3, 2018 8:56 AM<br>
>> *To:* oisf-users@lists.openinfosecfoundation.org<br>
>> <<a href="mailto:oisf-users@lists.openinfosecfoundation.org">mailto:oisf-users@lists.openinfosecfoundation.org</a>><br>
>> *Subject:* [Oisf-users] Crash in 4.0.5 when receiving packets<br>
>> <br>
>> Hey suricata users,<br>
>><br>
>> I upgraded suricata from 4.0.4 to 4.0.5 using the ppa last night<br>
>> and now suricata crashes when it (presumably) receives its first<br>
>> packet. I say presumably because if I physically bypass suricata,<br>
>> it doesn't crash. When I put it back inline, it crashes.<br>
>><br>
>> When I start it with:<br>
>> /usr/bin/suricata -c /etc/suricata/suricata.yaml --pidfile<br>
>> /var/run/suricata.pid --af-packet -vvv<br>
>><br>
>> It dies and spits the following to stdout:<br>
>> suricata: dump.c:337: do_dump: Assertion `value' failed.<br>
>><br>
>> Nothing has changed in my config between 4.0.4 and 4.0.5.<br>
>><br>
>> Peter<br>
>> _______________________________________________<br>
>> Suricata IDS Users mailing list:<br>
>> oisf-users@openinfosecfoundation.org<br>
>> <<a href="mailto:oisf-users@openinfosecfoundation.org">mailto:oisf-users@openinfosecfoundation.org</a>><br>
>> Site: <a href="https://eur04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsuricata-ids.org&data=02%7C01%7C%7C28e2f7303c8040cc0bdf08d5f908164d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636688735480209165&sdata=uJReSVXwVSz%2FnvLuzBH%2B7jhOFz0i7hOKBGdRSmnZZBQ%3D&reserved=0">
https://eur04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsuricata-ids.org&data=02%7C01%7C%7C28e2f7303c8040cc0bdf08d5f908164d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636688735480209165&sdata=uJReSVXwVSz%2FnvLuzBH%2B7jhOFz0i7hOKBGdRSmnZZBQ%3D&reserved=0</a>
| Support:<br>
>> <a href="https://eur04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsuricata-ids.org%2Fsupport%2F&data=02%7C01%7C%7C28e2f7303c8040cc0bdf08d5f908164d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636688735480209165&sdata=0TICuzhkTCPX%2F4B20k%2FBks%2Bk7z%2Fvruv1VTu6AQpVQ0Y%3D&reserved=0">
https://eur04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsuricata-ids.org%2Fsupport%2F&data=02%7C01%7C%7C28e2f7303c8040cc0bdf08d5f908164d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636688735480209165&sdata=0TICuzhkTCPX%2F4B20k%2FBks%2Bk7z%2Fvruv1VTu6AQpVQ0Y%3D&reserved=0</a><br>
>> List:<br>
>> <a href="https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.openinfosecfoundation.org%2Fmailman%2Flistinfo%2Foisf-users&data=02%7C01%7C%7C28e2f7303c8040cc0bdf08d5f908164d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636688735480209165&sdata=wZmXqIyYWwQDbgp%2FRU47rzgZjhxUt1Nro60Nfbte9Vs%3D&reserved=0">
https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.openinfosecfoundation.org%2Fmailman%2Flistinfo%2Foisf-users&data=02%7C01%7C%7C28e2f7303c8040cc0bdf08d5f908164d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636688735480209165&sdata=wZmXqIyYWwQDbgp%2FRU47rzgZjhxUt1Nro60Nfbte9Vs%3D&reserved=0</a><br>
>><br>
>> Conference: <a href="https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsuricon.net&data=02%7C01%7C%7C28e2f7303c8040cc0bdf08d5f908164d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636688735480209165&sdata=b6Dax0%2FJweRKgkUEKphUSgm9GzUyiKa8pf1%2B9zPRUJE%3D&reserved=0">
https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsuricon.net&data=02%7C01%7C%7C28e2f7303c8040cc0bdf08d5f908164d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636688735480209165&sdata=b6Dax0%2FJweRKgkUEKphUSgm9GzUyiKa8pf1%2B9zPRUJE%3D&reserved=0</a><br>
>> Trainings: <a href="https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsuricata-ids.org%2Ftraining%2F&data=02%7C01%7C%7C28e2f7303c8040cc0bdf08d5f908164d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636688735480209165&sdata=wytRAYt%2FdbVvAyINRhKNvNDtlhDUq%2BS%2FnRWJ%2FBpeilo%3D&reserved=0">
https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsuricata-ids.org%2Ftraining%2F&data=02%7C01%7C%7C28e2f7303c8040cc0bdf08d5f908164d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636688735480209165&sdata=wytRAYt%2FdbVvAyINRhKNvNDtlhDUq%2BS%2FnRWJ%2FBpeilo%3D&reserved=0</a><br>
> <br>
> <br>
> <br>
> _______________________________________________<br>
> Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>
> Site: <a href="https://eur04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsuricata-ids.org&data=02%7C01%7C%7C28e2f7303c8040cc0bdf08d5f908164d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636688735480209165&sdata=uJReSVXwVSz%2FnvLuzBH%2B7jhOFz0i7hOKBGdRSmnZZBQ%3D&reserved=0">
https://eur04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsuricata-ids.org&data=02%7C01%7C%7C28e2f7303c8040cc0bdf08d5f908164d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636688735480209165&sdata=uJReSVXwVSz%2FnvLuzBH%2B7jhOFz0i7hOKBGdRSmnZZBQ%3D&reserved=0</a>
| Support: <a href="https://eur04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsuricata-ids.org%2Fsupport%2F&data=02%7C01%7C%7C28e2f7303c8040cc0bdf08d5f908164d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636688735480209165&sdata=0TICuzhkTCPX%2F4B20k%2FBks%2Bk7z%2Fvruv1VTu6AQpVQ0Y%3D&reserved=0">
https://eur04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsuricata-ids.org%2Fsupport%2F&data=02%7C01%7C%7C28e2f7303c8040cc0bdf08d5f908164d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636688735480209165&sdata=0TICuzhkTCPX%2F4B20k%2FBks%2Bk7z%2Fvruv1VTu6AQpVQ0Y%3D&reserved=0</a><br>
> List: <a href="https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.openinfosecfoundation.org%2Fmailman%2Flistinfo%2Foisf-users&data=02%7C01%7C%7C28e2f7303c8040cc0bdf08d5f908164d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636688735480209165&sdata=wZmXqIyYWwQDbgp%2FRU47rzgZjhxUt1Nro60Nfbte9Vs%3D&reserved=0">
https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.openinfosecfoundation.org%2Fmailman%2Flistinfo%2Foisf-users&data=02%7C01%7C%7C28e2f7303c8040cc0bdf08d5f908164d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636688735480209165&sdata=wZmXqIyYWwQDbgp%2FRU47rzgZjhxUt1Nro60Nfbte9Vs%3D&reserved=0</a><br>
> <br>
> Conference: <a href="https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsuricon.net&data=02%7C01%7C%7C28e2f7303c8040cc0bdf08d5f908164d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636688735480209165&sdata=b6Dax0%2FJweRKgkUEKphUSgm9GzUyiKa8pf1%2B9zPRUJE%3D&reserved=0">
https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsuricon.net&data=02%7C01%7C%7C28e2f7303c8040cc0bdf08d5f908164d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636688735480209165&sdata=b6Dax0%2FJweRKgkUEKphUSgm9GzUyiKa8pf1%2B9zPRUJE%3D&reserved=0</a><br>
> Trainings: <a href="https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsuricata-ids.org%2Ftraining%2F&data=02%7C01%7C%7C28e2f7303c8040cc0bdf08d5f908164d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636688735480209165&sdata=wytRAYt%2FdbVvAyINRhKNvNDtlhDUq%2BS%2FnRWJ%2FBpeilo%3D&reserved=0">
https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsuricata-ids.org%2Ftraining%2F&data=02%7C01%7C%7C28e2f7303c8040cc0bdf08d5f908164d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636688735480209165&sdata=wytRAYt%2FdbVvAyINRhKNvNDtlhDUq%2BS%2FnRWJ%2FBpeilo%3D&reserved=0</a><br>
> <br>
<br>
<br>
-- <br>
---------------------------------------------<br>
Victor Julien<br>
<a href="https://eur04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.inliniac.net%2F&data=02%7C01%7C%7C28e2f7303c8040cc0bdf08d5f908164d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636688735480209165&sdata=9F0zsPHZi50oDnlwTuiCqBTkO9b%2F65K%2FoTvSVwpC1Pk%3D&reserved=0">https://eur04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.inliniac.net%2F&data=02%7C01%7C%7C28e2f7303c8040cc0bdf08d5f908164d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636688735480209165&sdata=9F0zsPHZi50oDnlwTuiCqBTkO9b%2F65K%2FoTvSVwpC1Pk%3D&reserved=0</a><br>
PGP: <a href="https://eur04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.inliniac.net%2Fvictorjulien.asc&data=02%7C01%7C%7C28e2f7303c8040cc0bdf08d5f908164d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636688735480209165&sdata=NNVsx5Tgkcv0fijh5E%2BTKb79sYacWs7ehqnNTIBaZeg%3D&reserved=0">
https://eur04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.inliniac.net%2Fvictorjulien.asc&data=02%7C01%7C%7C28e2f7303c8040cc0bdf08d5f908164d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636688735480209165&sdata=NNVsx5Tgkcv0fijh5E%2BTKb79sYacWs7ehqnNTIBaZeg%3D&reserved=0</a><br>
---------------------------------------------<br>
<br>
_______________________________________________<br>
Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>
Site: <a href="https://eur04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsuricata-ids.org&data=02%7C01%7C%7C28e2f7303c8040cc0bdf08d5f908164d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636688735480209165&sdata=uJReSVXwVSz%2FnvLuzBH%2B7jhOFz0i7hOKBGdRSmnZZBQ%3D&reserved=0">
https://eur04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsuricata-ids.org&data=02%7C01%7C%7C28e2f7303c8040cc0bdf08d5f908164d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636688735480209165&sdata=uJReSVXwVSz%2FnvLuzBH%2B7jhOFz0i7hOKBGdRSmnZZBQ%3D&reserved=0</a>
| Support: <a href="https://eur04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsuricata-ids.org%2Fsupport%2F&data=02%7C01%7C%7C28e2f7303c8040cc0bdf08d5f908164d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636688735480209165&sdata=0TICuzhkTCPX%2F4B20k%2FBks%2Bk7z%2Fvruv1VTu6AQpVQ0Y%3D&reserved=0">
https://eur04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsuricata-ids.org%2Fsupport%2F&data=02%7C01%7C%7C28e2f7303c8040cc0bdf08d5f908164d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636688735480209165&sdata=0TICuzhkTCPX%2F4B20k%2FBks%2Bk7z%2Fvruv1VTu6AQpVQ0Y%3D&reserved=0</a><br>
List: <a href="https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.openinfosecfoundation.org%2Fmailman%2Flistinfo%2Foisf-users&data=02%7C01%7C%7C28e2f7303c8040cc0bdf08d5f908164d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636688735480209165&sdata=wZmXqIyYWwQDbgp%2FRU47rzgZjhxUt1Nro60Nfbte9Vs%3D&reserved=0">
https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.openinfosecfoundation.org%2Fmailman%2Flistinfo%2Foisf-users&data=02%7C01%7C%7C28e2f7303c8040cc0bdf08d5f908164d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636688735480209165&sdata=wZmXqIyYWwQDbgp%2FRU47rzgZjhxUt1Nro60Nfbte9Vs%3D&reserved=0</a><br>
<br>
Conference: <a href="https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsuricon.net&data=02%7C01%7C%7C28e2f7303c8040cc0bdf08d5f908164d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636688735480209165&sdata=b6Dax0%2FJweRKgkUEKphUSgm9GzUyiKa8pf1%2B9zPRUJE%3D&reserved=0">
https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsuricon.net&data=02%7C01%7C%7C28e2f7303c8040cc0bdf08d5f908164d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636688735480209165&sdata=b6Dax0%2FJweRKgkUEKphUSgm9GzUyiKa8pf1%2B9zPRUJE%3D&reserved=0</a><br>
Trainings: <a href="https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsuricata-ids.org%2Ftraining%2F&data=02%7C01%7C%7C28e2f7303c8040cc0bdf08d5f908164d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636688735480209165&sdata=wytRAYt%2FdbVvAyINRhKNvNDtlhDUq%2BS%2FnRWJ%2FBpeilo%3D&reserved=0">
https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsuricata-ids.org%2Ftraining%2F&data=02%7C01%7C%7C28e2f7303c8040cc0bdf08d5f908164d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636688735480209165&sdata=wytRAYt%2FdbVvAyINRhKNvNDtlhDUq%2BS%2FnRWJ%2FBpeilo%3D&reserved=0</a></div>
</span></font></div>
</div>
</div>
</body>
</html>