Hi,
i am using the current version of bro-ids 1.3.2, i am getting segmentation fault error while running on a pcap file. I saw that frag.cc has to be modified previously
@@ -161,10 +161,11 @@
if ( b->next )
{
// We have a hole.
- if ( b->seq >= frag_size )
+ if ( b->upper >= frag_size )
{
IP_Hdr proto_h((const struct ip*) proto_hdr);
s->Weird(“fragment_size_inconsistency”, &proto_h);
+ frag_size = b->upper;
}
else
return;
@@ -174,6 +175,7 @@
{
IP_Hdr proto_h((const struct ip*) proto_hdr);
s->Weird(“fragment_size_inconsistency”, &proto_h);
+ frag_size = last_block->upper;
}
else if ( last_block->upper < frag_size )
i found the only one change to be modified in Frag.cc (bolded one), do I need to remove few lines after return in the file. Only adding the bolded line and again make and make install… still it is giving me segmentation fault… i am having older version of bro in the same system… does it affect in any way…
thanks.