Snort Forums Archive

Archive Home » Snort Development » Blank line in snort.conf generates a memory fault (v2.3.3).

Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.

[ Notice: Full Version of This Topic ]

Blank line in snort.conf generates a memory fault (v2.3.3).

Posted by Rickard on June 09, 2005 03:28:59

A blank line in snort.conf makes snort dump core. This only happens if the line is \r\n terminated, i.e. the file is edited in a Windows environment and then sent to a Unix sensor. So if snort.conf contains 3 lines like shown below snort core dumps (the \r\n are added for clarity):

\r\n
var HOME_NET any\r\n
var EXTERNAL_NET any\r\n

..but not in this scenario (3 lines):

#
var HOME_NET any\r\n
var EXTERNAL_NET any\r\n

This is not really an issue, you can just stop using blank lines in the config and the problem disappears.

I'm using Windows XP and PSCP (Putty SCP) for editing. The sensor is a OpenBSD 3.5 running snort v2.3.3.

Posted by roesch on June 28, 2005 11:56:57

Can you send a snort.conf file that has this problem to me? My email address is all over the documentation in the the headers of a lot of the source code files if you're wondering (like in the comments block at the start of snort.c)...

-Marty