Bug with malformed host in filter

elof2 at sentor.se elof2 at sentor.se
Mon Feb 25 09:02:47 EST 2013

Hi Carter!

I stumbled on to a bug when accidentally executing a ra command with an 
incomplete IP address.
Strangely enough, the error-detection make different descisions depending 
of its place in the filter string.


#ra -Zb -nr argus.log - host and host 10

pid 1907 (ra), uid 0: exited on signal 11 (core dumped)
host and host 10 filter syntax error

The filter "tcp and host 10" and other elements before "host 10" also 

However, a filter of just "host 10" by itself does not fail, nor does 
"host 10 and host"

(ra version


More information about the argus mailing list