ra clients (3.0.5.16) segfault when displaying a flow record with protocol 33079 (IPX)

The Branches branchbunch at gmail.com
Tue Jul 12 12:11:20 EDT 2011


Carter,

On a 32 bit CentOS 5.6 host, when I use argus on a tcpdump capture file 
consisting of a single packet of IP protocol  33079 (coming from an HP 
network printer I believe)

      argus -X -r ipx.cap -w ipx.arg

I get an immediate segfault if I then run

     # ra -r ipx.arg -n
     Segmentation fault

but if I force it to not resolve the protocol name, it works fine

     # ra -r ipx.arg -nn
    10:00:02.549418  e         33079   0:30:c1:c4:80:b1.0         ->  
ff:ff:ff:ff:ff:ff.0             1        110   INT

It also works fine if I use a -w parameter instead of having ra send 
textual flow summaries to stdout.

When I originally encountered this issue, I had a full tcpdump cap file 
with these IPX packets interspersed.  When I tried to use ra on the 
file, the records scrolled by until an IPX flow was hit, at which point 
it segfaulted.

Sounds like an easy bug fix to me.  If it would help, I'm happy to pass 
on the tcpdump cap file with the offending packet in it.

Kevin



More information about the argus mailing list