[Oisf-users] Several errors with http parser after updating to 1.1.1

[Peter Manev]

Hi,

It does look like something recently discovered but not confirmed yet, as
of where/what exactly triggers it.
Do you have the same results if you run Suricata without --enable-profiling?

Thanks

On Sat, Dec 17, 2011 at 9:41 PM, carlopmart <carlopmart at gmail.com> wrote:

> On 12/16/2011 02:30 PM, carlopmart wrote:
> > Hi all,
> >
> > After updating my suricata 1.1 to 1.1.1, I can see several errors from
> > http parser, like in this thread:
> >
> >
> http://lists.openinfosecfoundation.org/pipermail/oisf-users/2011-December/001150.html
> >
> >
> > My errors:
> >
> > [100066] 16/12/2011 -- 12:29:04 - (app-layer-htp.c:487) <Error>
> > (HTPHandleResponseData) -- [ERRCODE: SC_ERR_ALPARSER(59)] - Error in
> > parsing HTTP server response: [1] [htp_response.c] [677] Unable to ma
> > tch response to request
> > [100066] 16/12/2011 -- 12:29:04 - (app-layer-parser.c:969) <Error>
> > (AppLayerParse) -- [ERRCODE: SC_ERR_ALPARSER(59)] - Error occured in
> > parsing "http" app layer protocol, using network protocol 6, sourc
> > e IP address 172.25.50.25, destination IP address 85.214.82.144, src
> > port 35859 and dst port 80
> > [100066] 16/12/2011 -- 13:03:38 - (app-layer-htp.c:487) <Error>
> > (HTPHandleResponseData) -- [ERRCODE: SC_ERR_ALPARSER(59)] - Error in
> > parsing HTTP server response: [1] [htp_response.c] [677] Unable to ma
> > tch response to request
> > [100066] 16/12/2011 -- 13:03:38 - (app-layer-parser.c:969) <Error>
> > (AppLayerParse) -- [ERRCODE: SC_ERR_ALPARSER(59)] - Error occured in
> > parsing "http" app layer protocol, using network protocol 6, sourc
> > e IP address 172.25.50.25, destination IP address 85.214.82.144, src
> > port 55596 and dst port 80
> >
> > I have compiled suricata with "--enable-profiling --enable-ipfw" flags
> > under FreeBSD 8.1 32bit host.
> >
> > Is this a known bug in stable version??
> >
> > Thanks.
> >
>
> Please, any help??
>
>
> --
> CL Martinez
> carlopmart {at} gmail {d0t} com
> _______________________________________________
> Oisf-users mailing list
> Oisf-users at openinfosecfoundation.org
> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>



-- 
Peter Manev
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20111218/41789159/attachment-0002.html>