<div dir="auto">Thanks for picking up on that so quickly. Upgrading fixed my crashes too.<div dir="auto"><br></div><div dir="auto">Peter</div></div><br><div class="gmail_quote"><div dir="ltr">On Fri, Aug 3, 2018, 2:03 AM Victor Julien <<a href="mailto:lists@inliniac.net">lists@inliniac.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Ubuntu had released a broken libjansson upgrade yesterday, but it should<br>
be fixed if you upgrade again to 2.5-2ubuntu0.2<br>
<br>
# dpkg --list libjansson*<br>
...<br>
ii libjansson4:i386 2.5-2ubuntu0.2<br>
i386 C library for encoding, decoding and<br>
manipulating JSON data<br>
<br>
<br>
Simply another apt update && apt upgrade should fix it.<br>
<br>
See: <a href="https://redmine.openinfosecfoundation.org/issues/2560" rel="noreferrer noreferrer" target="_blank">https://redmine.openinfosecfoundation.org/issues/2560</a><br>
<br>
On 03-08-18 03:27, Peter Fyon wrote:<br>
> I'm on Ubuntu 14.04 in IPS mode using af_packet. <br>
> <br>
> On Thu, Aug 2, 2018, 9:04 PM Peter Manev <<a href="mailto:petermanev@gmail.com" target="_blank" rel="noreferrer">petermanev@gmail.com</a><br>
> <mailto:<a href="mailto:petermanev@gmail.com" target="_blank" rel="noreferrer">petermanev@gmail.com</a>>> wrote:<br>
> <br>
> <br>
> <br>
> On 3 Aug 2018, at 01:26, Serge Malev <<a href="mailto:smalev@hotmail.com" target="_blank" rel="noreferrer">smalev@hotmail.com</a><br>
> <mailto:<a href="mailto:smalev@hotmail.com" target="_blank" rel="noreferrer">smalev@hotmail.com</a>>> wrote:<br>
> <br>
>> I am having the same problem. Suricata tries to restart every 5<br>
>> minutes and crashes with the same error.<br>
>><br>
>><br>
> <br>
> Hi,<br>
> <br>
> Are you using IDS or IPS mode?<br>
> <br>
> Thank you<br>
> <br>
>><br>
>><br>
>><br>
>> ------------------------------------------------------------------------<br>
>> *From:* Oisf-users<br>
>> <<a href="mailto:oisf-users-bounces@lists.openinfosecfoundation.org" target="_blank" rel="noreferrer">oisf-users-bounces@lists.openinfosecfoundation.org</a><br>
>> <mailto:<a href="mailto:oisf-users-bounces@lists.openinfosecfoundation.org" target="_blank" rel="noreferrer">oisf-users-bounces@lists.openinfosecfoundation.org</a>>> on<br>
>> behalf of Peter Fyon <<a href="mailto:peter.fyon@gmail.com" target="_blank" rel="noreferrer">peter.fyon@gmail.com</a><br>
>> <mailto:<a href="mailto:peter.fyon@gmail.com" target="_blank" rel="noreferrer">peter.fyon@gmail.com</a>>><br>
>> *Sent:* Friday, August 3, 2018 8:56 AM<br>
>> *To:* <a href="mailto:oisf-users@lists.openinfosecfoundation.org" target="_blank" rel="noreferrer">oisf-users@lists.openinfosecfoundation.org</a><br>
>> <mailto:<a href="mailto:oisf-users@lists.openinfosecfoundation.org" target="_blank" rel="noreferrer">oisf-users@lists.openinfosecfoundation.org</a>><br>
>> *Subject:* [Oisf-users] Crash in 4.0.5 when receiving packets<br>
>> <br>
>> Hey suricata users,<br>
>><br>
>> I upgraded suricata from 4.0.4 to 4.0.5 using the ppa last night<br>
>> and now suricata crashes when it (presumably) receives its first<br>
>> packet. I say presumably because if I physically bypass suricata,<br>
>> it doesn't crash. When I put it back inline, it crashes.<br>
>><br>
>> When I start it with:<br>
>> /usr/bin/suricata -c /etc/suricata/suricata.yaml --pidfile<br>
>> /var/run/suricata.pid --af-packet -vvv<br>
>><br>
>> It dies and spits the following to stdout:<br>
>> suricata: dump.c:337: do_dump: Assertion `value' failed.<br>
>><br>
>> Nothing has changed in my config between 4.0.4 and 4.0.5.<br>
>><br>
>> Peter<br>
>> _______________________________________________<br>
>> Suricata IDS Users mailing list:<br>
>> <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank" rel="noreferrer">oisf-users@openinfosecfoundation.org</a><br>
>> <mailto:<a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank" rel="noreferrer">oisf-users@openinfosecfoundation.org</a>><br>
>> Site: <a href="http://suricata-ids.org" rel="noreferrer noreferrer" target="_blank">http://suricata-ids.org</a> | Support:<br>
>> <a href="http://suricata-ids.org/support/" rel="noreferrer noreferrer" target="_blank">http://suricata-ids.org/support/</a><br>
>> List:<br>
>> <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel="noreferrer noreferrer" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
>><br>
>> Conference: <a href="https://suricon.net" rel="noreferrer noreferrer" target="_blank">https://suricon.net</a><br>
>> Trainings: <a href="https://suricata-ids.org/training/" rel="noreferrer noreferrer" target="_blank">https://suricata-ids.org/training/</a><br>
> <br>
> <br>
> <br>
> _______________________________________________<br>
> Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank" rel="noreferrer">oisf-users@openinfosecfoundation.org</a><br>
> Site: <a href="http://suricata-ids.org" rel="noreferrer noreferrer" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" rel="noreferrer noreferrer" target="_blank">http://suricata-ids.org/support/</a><br>
> List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel="noreferrer noreferrer" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
> <br>
> Conference: <a href="https://suricon.net" rel="noreferrer noreferrer" target="_blank">https://suricon.net</a><br>
> Trainings: <a href="https://suricata-ids.org/training/" rel="noreferrer noreferrer" target="_blank">https://suricata-ids.org/training/</a><br>
> <br>
<br>
<br>
-- <br>
---------------------------------------------<br>
Victor Julien<br>
<a href="http://www.inliniac.net/" rel="noreferrer noreferrer" target="_blank">http://www.inliniac.net/</a><br>
PGP: <a href="http://www.inliniac.net/victorjulien.asc" rel="noreferrer noreferrer" target="_blank">http://www.inliniac.net/victorjulien.asc</a><br>
---------------------------------------------<br>
<br>
_______________________________________________<br>
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank" rel="noreferrer">oisf-users@openinfosecfoundation.org</a><br>
Site: <a href="http://suricata-ids.org" rel="noreferrer noreferrer" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" rel="noreferrer noreferrer" target="_blank">http://suricata-ids.org/support/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel="noreferrer noreferrer" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
<br>
Conference: <a href="https://suricon.net" rel="noreferrer noreferrer" target="_blank">https://suricon.net</a><br>
Trainings: <a href="https://suricata-ids.org/training/" rel="noreferrer noreferrer" target="_blank">https://suricata-ids.org/training/</a></blockquote></div>