4 Jul 23:34
no smac an dmac with ubuntu
Jochen Haemmerle <mail <at> jhaemmerle.org>
2008-07-04 21:34:27 GMT
2008-07-04 21:34:27 GMT
Hi, I discovered a strange problem with argus and ubuntu (7.10 and 8.04). I use argus to create an "argus.dump" file argus -r pcapfile -w argus.dump If I then use ra to show mit saddr smac daddr and dmac it only shows saddr and daddr and reports that the smac and dmac are empty. ra -M xml -r argus.dump Here comes the strange thing. If I create the argus.dump file with my Debian (unstable) machine then ra displays everything as expected. Therefore I guess there's something wrong with my argus binary, but what? I use argus-3.0.0 build from source using the libpcap and the other dependencies from the package management (libpcap 0.9.8). Is there anything wrong with ubuntu? regards Jochen
).
Peter Van Epp / Operations and Technical Support
....
(gdb) print ip
$1 = (struct ip *) 0x0
(gdb) print *ip
Cannot access memory at address 0x0
(gdb)
On Mon, Jul 7, 2008 at 11:00 AM, Carter Bullard <carter <at> qosient.com> wrote:
> Hey Will,
> Maybe an alignment problem. What happens when
> you print the ip header in gdb?
>
> (gdb) print ip
> (gdb) print *ip
>
> you may need to remove the -O directive in the ./argus/Makefile
> so that gdb doesn't optimize out the local variables, so we can
> see what argus has done.
>
> So what kind of machine is this?
>
> Carter
>
> On Jul 7, 2008, at 11:07 AM, Will Metcalf wrote:
>
>> I updated to the latest version of pf_ring enabled libpcap, which
>> implements the ability to set a per process bucket len that is based
>> on caplen from libpcap. When compiling Argus against this lib it
>> segv's after logging a couple of flows Anybody have any ideas?
>> Regards,
>>
>> Will
>>
>>
>>
>> gdb /usr/sbin/argus core.4729
>> GNU gdb Red Hat Linux (6.5-37.el5_2.2rh)
>> Copyright (C) 2006 Free Software Foundation, Inc.
>> GDB is free software, covered by the GNU General Public License, and you
>> are
>> welcome to change it and/or distribute copies of it under certain
>> conditions.
>> Type "show copying" to see the conditions.
>> There is absolutely no warranty for GDB. Type "show warranty" for
>> details.
>> This GDB was configured as "i386-redhat-linux-gnu"...Using host
>> libthread_db library "/lib/libthread_db.so.1".
>>
>>
>> warning: Can't read pathname for load map: Input/output error.
>> Reading symbols from /usr/lib/libpcap.so.0.9.7...done.
>> Loaded symbols for /usr/lib/libpcap.so.0.9.7
>> Reading symbols from /usr/lib/libpfring.so...done.
>> Loaded symbols for /usr/lib/libpfring.so
>> Reading symbols from /lib/libpthread.so.0...done.
>> Loaded symbols for /lib/libpthread.so.0
>> Reading symbols from /usr/lib/libwrap.so.0...done.
>> Loaded symbols for /usr/lib/libwrap.so.0
>> Reading symbols from /lib/libnsl.so.1...done.
>> Loaded symbols for /lib/libnsl.so.1
>> Reading symbols from /lib/libm.so.6...done.
>> Loaded symbols for /lib/libm.so.6
>> Reading symbols from /lib/libc.so.6...done.
>> Loaded symbols for /lib/libc.so.6
>> Reading symbols from /lib/ld-linux.so.2...done.
>> Loaded symbols for /lib/ld-linux.so.2
>> Reading symbols from /lib/libnss_files.so.2...done.
>> Loaded symbols for /lib/libnss_files.so.2
>> Core was generated by `/usr/sbin/argus -d -J -w
>> /var/log/argusoutput.ra -i eth0'.
>> Program terminated with signal 11, Segmentation fault.
>> #0 ArgusCreateIPv4Flow (model=0x8bde008, ip=0x0) at ArgusModeler.c:3627
>> 3627 unsigned char *nxtHdr = (unsigned char *)((char *)ip +
>> (ip->ip_hl << 2));
>> (gdb) bt full
>> #0 ArgusCreateIPv4Flow (model=0x8bde008, ip=0x0) at ArgusModeler.c:3627
>> nxtHdr = <value optimized out>
>> sport = <value optimized out>
>> dport = <value optimized out>
>> proto = <value optimized out>
>> len = <value optimized out>
>> hlen = <value optimized out>
>> ArgusOptionLen = <value optimized out>
>> #1 0x08053273 in ArgusProcessPacket (src=0xb7ea8008, p=0x8bdf2f0
>> "������", length=251, tvp=0xbffd8344, type=-1) at ArgusModeler.c:1257
>> tsbuf = {tv_sec = 1953653108, tv_nsec = -1073904964}
>> tdiff = 4294967392
>> rtdiff = <value optimized out>
>> tvalue = <value optimized out>
>> model = (struct ArgusModelerStruct *) 0x8bde008
>> flow = <value optimized out>
>> nflow = <value optimized out>
>> ptr = 0x8bdf2f0 "������"
>> value = 0
>> retn = <value optimized out>
>> #2 0x080554de in ArgusEtherPacket (user=0xb7ea8008 "", h=0x8bdf2c4,
>> p=0x8bdf2f0 "������") at ArgusSource.c:716
>> caplen = 96
>> length = 251
>> tvpbuf = {tv_sec = 1215442055, tv_usec = 648975}
>> statbuf = {st_dev = 65522, __pad1 = 0, __st_ino = 0, st_mode =
>> 0, st_nlink = 0, st_uid = 469434368, st_gid = 4327000, st_rdev =
>> 18344976773382976, __pad2 = 2064, st_size = 4294967296,
>> st_blksize = 107793408, st_blocks = 4147592, st_atim = {tv_sec = 0,
>> tv_nsec = -1073904808}, st_mtim = {tv_sec = 4003570, tv_nsec =
>> 146665712}, st_ctim = {tv_sec = 1, tv_nsec = 4001120},
>> st_ino = 13834360246576710476}
>> #3 0x08056f38 in ArgusGetPackets (src=0xb7ea8008) at ArgusSource.c:2139
>> pkt_data = (const u_char *) 0x8bdf2f0 "������"
>> pkts = 840
>> cnt = 1
>> header = (struct pcap_pkthdr *) 0x8bdf2c4
>> retn = <value optimized out>
>> ArgusReadMask = {__fds_bits = {0 <repeats 32 times>}}
>> ArgusWriteMask = {__fds_bits = {0 <repeats 32 times>}}
>> ArgusExceptMask = {__fds_bits = {0 <repeats 32 times>}}
>> tmp = <value optimized out>
>> i = 0
>> width = 1
>> noerror = 1
>> fd = <value optimized out>
>> found = 1
>> up = 1
>> notselectable = 0
>> fds = {1, -1, -1, -1, -1}
>> wait = {tv_sec = 0, tv_usec = 0}
>> #4 0x0804c422 in main (argc=7, argv=0xbffd8ab4) at argus.c:530
>> eptr = 0x7 <Address 0x7 out of bounds>
>> ptr = 0xb7f3c708 "�\aB"
>> commandlinew = 1
>> doconf = 0
>> i = 7
>> pid = <value optimized out>
>> tmparg = <value optimized out>
>> filter = <value optimized out>
>> ---Type <return> to continue, or q <return> to quit---
>> statbuf = {st_dev = 64768, __pad1 = 0, __st_ino = 43156691,
>> st_mode = 33188, st_nlink = 1, st_uid = 0, st_gid = 0, st_rdev = 0,
>> __pad2 = 0, st_size = 12807, st_blksize = 4096, st_blocks = 40,
>> st_atim = {tv_sec = 1215441879, tv_nsec = 0}, st_mtim = {tv_sec =
>> 1215122542, tv_nsec = 0}, st_ctim = {tv_sec = 1215122628, tv_nsec =
>> 0}, st_ino = 43156691}
>> op = <value optimized out>
>> commandlinei = 1
>> path = "/etc/argus.conf", '\0' <repeats 8176 times>
>> #5 0x00438dec in __libc_start_main () from /lib/libc.so.6
>> No symbol table info available.
>> #6 0x0804a4b1 in _start ()
>> No symbol table info available.
>> (gdb)
>
>
Regards,
Will
On Mon, Jul 7, 2008 at 2:05 PM, Peter Van Epp <vanepp <at> sfu.ca> wrote:
> On Mon, Jul 07, 2008 at 01:27:58PM -0500, Will Metcalf wrote:
>> Everything is intel 32-bit.
>>
>
> For what its worth (probably not much, since it doesn't work for
> you 
RSS Feed