argus ppp traffic

[Carter Bullard]

OK, I'll grab the file and take a look.  Maybe a truncated packet...definately a bug !!
Carter

> On Apr 25, 2014, at 5:47 AM, CS Lee <geek00l at gmail.com> wrote:
> 
> hi Carter,
> 
> Same, I have tested both and the segfault happens.
> 
> 
>> On Fri, Apr 25, 2014 at 8:46 PM, Carter Bullard <carter at qosient.com> wrote:
>> Hey CS Lee,
>> If you turn TD off, does it get better ???
>> Carter
>> 
>> Carter Bullard, QoSient, LLC
>> 150 E. 57th Street Suite 12D
>> New York, New York 10022
>> +1 212 588-9133 Phone
>> +1 212 588-9134 Fax
>> 
>>> On Apr 24, 2014, at 6:49 PM, CS Lee <geek00l at gmail.com> wrote:
>>> 
>>> hi Carter, 
>>> 
>>> Yes, I have enabled tunnel discovery in argus.conf but still segfault, I tried it with other dump and it seems to work. For this Teredo.pcap, the header started with 
>>> 
>>> FF03 0021 and that should be ipv4 over ppp.
>>> 
>>> 
>>>> On Fri, Apr 25, 2014 at 9:16 AM, Carter Bullard <carter at qosient.com> wrote:
>>>> Hey CS Lee,
>>>> do you have tunnel discovery on in your argus.conf file ???
>>>> the file name suggests that its teredo, which we will try to parse if that option is " yes ".
>>>> Carter
>>>> 
>>>>> On Apr 24, 2014, at 4:17 PM, CS Lee <geek00l at gmail.com> wrote:
>>>>> 
>>>>> hi Carter,
>>>>> 
>>>>> I downloaded the pcap from pcapr.net - 
>>>>> 
>>>>> http://www.pcapr.net/view/tyson.key/2009/9/3/13/Teredo.pcap.html
>>>>> 
>>>>> And I run into segfault when convert the packets into flow, it seems that it is ppp encapsulated traffic -
>>>>> 
>>>>> gdb /usr/local/stow/argus-3.0.7.5-debug/sbin/argus 
>>>>> GNU gdb (Ubuntu 7.7-0ubuntu3) 7.7
>>>>> Copyright (C) 2014 Free Software Foundation, Inc.
>>>>> License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
>>>>> This is free software: you are free to change and redistribute it.
>>>>> There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
>>>>> and "show warranty" for details.
>>>>> This GDB was configured as "x86_64-linux-gnu".
>>>>> Type "show configuration" for configuration details.
>>>>> For bug reporting instructions, please see:
>>>>> <http://www.gnu.org/software/gdb/bugs/>.
>>>>> Find the GDB manual and other documentation resources online at:
>>>>> <http://www.gnu.org/software/gdb/documentation/>.
>>>>> For help, type "help".
>>>>> Type "apropos word" to search for commands related to "word"...
>>>>> Reading symbols from /usr/local/stow/argus-3.0.7.5-debug/sbin/argus...done.
>>>>> (gdb) run -r Teredo.pcap -w Teredo.arg3
>>>>> Starting program: /usr/local/stow/argus-3.0.7.5-debug/sbin/argus -r Teredo.pcap -w Teredo.arg3
>>>>> [Thread debugging using libthread_db enabled]
>>>>> Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
>>>>> [New Thread 0x7ffff6a81700 (LWP 22830)]
>>>>> [New Thread 0x7ffff5df4700 (LWP 22831)]
>>>>> 
>>>>> Program received signal SIGSEGV, Segmentation fault.
>>>>> [Switching to Thread 0x7ffff5df4700 (LWP 22831)]
>>>>> ArgusCreateIPv4Flow (model=model at entry=0x7ffff7e0f010, ip=0x0) at ArgusModeler.c:4076
>>>>> 4076       unsigned char *nxtHdr = (unsigned char *)((char *)ip + (ip->ip_hl << 2));
>>>>> (gdb) where
>>>>> #0  ArgusCreateIPv4Flow (model=model at entry=0x7ffff7e0f010, ip=0x0) at ArgusModeler.c:4076
>>>>> #1  0x000000000040cac1 in ArgusCreateFlow (model=model at entry=0x7ffff7e0f010, 
>>>>>     ptr=ptr at entry=0x66ad44, length=length at entry=89) at ArgusModeler.c:1861
>>>>> #2  0x000000000040d3bd in ArgusProcessIpPacket (model=0x7ffff7e0f010, 
>>>>>     ip=ip at entry=0x66ad44, length=length at entry=89, tvp=tvp at entry=0x7ffff5df3a40)
>>>>>     at ArgusModeler.c:1675
>>>>> #3  0x000000000040e17b in ArgusPppPacket (user=0x7ffff5e76010 "", h=0x7ffff5df3b30, 
>>>>>     p=0x66ad40 "\377\003") at ArgusSource.c:3229
>>>>> #4  0x00007ffff7bb8b71 in ?? () from /usr/lib/x86_64-linux-gnu/libpcap.so.0.8
>>>>> #5  0x00000000004138a4 in ArgusGetPackets (arg=0x7ffff5e76010) at ArgusSource.c:4113
>>>>> #6  0x00007ffff7986182 in start_thread (arg=0x7ffff5df4700) at pthread_create.c:312
>>>>> #7  0x00007ffff719430d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111
>>>>> 
>>>>> 
>>>>> -- 
>>>>> Best Regards,
>>>>> 
>>>>> CS Lee<geek00L[at]gmail.com>
>>>>> 
>>>>> http://geek00l.blogspot.com
>>>>> http://defcraft.com.my
>>> 
>>> 
>>> 
>>> -- 
>>> Best Regards,
>>> 
>>> CS Lee<geek00L[at]gmail.com>
>>> 
>>> http://geek00l.blogspot.com
>>> http://defcraft.net
> 
> 
> 
> -- 
> Best Regards,
> 
> CS Lee<geek00L[at]gmail.com>
> 
> http://geek00l.blogspot.com
> http://defcraft.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20140425/ac60e4df/attachment.html>