Running the following ntop: Welcome to ntop v.4.0 (64 bit) [Configured on Oct 11 2010 13:24:50, built on Oct 11 2010 13:25:27]
With the following build configuration: ./configure --prefix=/usr/local --enable-jumbo-frames --enable-snmp --localedir=/usr/share/locale On the following platform: System Version: Mac OS X 10.6.4 (10F569) Kernel Version: Darwin 10.4.0 Darwin savematter-lm 10.4.0 Darwin Kernel Version 10.4.0: Fri Apr 23 18:28:53 PDT 2010; root:xnu-1504.7.4~1/RELEASE_I386 i386 i686-apple-darwin10-gcc-4.2.1 (GCC) 4.2.1 (Apple Inc. build 5664) With the following arguments: ntop -P ./sbs-tcpdump-tmp -Q ./sbs-tcpdump-tmp -4 -c -n -x 1048576 --known-subnets 67.195.0.0/16=local -f sbs-tcpdump-2010-10-09.cap Results in the following segmentation fault: Program received signal EXC_BAD_ACCESS, Could not access memory. Reason: KERN_INVALID_ADDRESS at address: 0x0000000000000018 [Switching to process 8771] 0x00000001000dcb8a in handleTCPSession (h=0x102f80e40, fragmentedData=0, tcpWin=53270, srcHost=0x104800000, sport=80, dstHost=0x10193b400, dport=4076, sent_length=1500, rcvd_length=0, tp=0x102f7e5e0, packetDataLength=1460, packetData=0x102f7eaf6 "..."..., actualDeviceId=<value temporarily unavailable, due to optimizations>, newSession=0x102f7e67a) at sessions.c:1095 1095 allocHostTrafficCounterMemory(srcHost, protocolInfo->httpStats, sizeof(ServiceStats)); (gdb) bt #0 0x00000001000dcb8a in handleTCPSession (h=0x102f80e40, fragmentedData=0, tcpWin=53270, srcHost=0x104800000, sport=80, dstHost=0x10193b400, dport=4076, sent_length=1500, rcvd_length=0, tp=0x102f7e5e0, packetDataLength=1460, packetData=0x102f7eaf6 "..."..., actualDeviceId=<value temporarily unavailable, due to optimizations>, newSession=0x102f7e67a) at sessions.c:1095 #1 0x00000001000de602 in handleSession (h=0x102f80e40, fragmentedData=<value temporarily unavailable, due to optimizations>, tcpWin=53270, srcHost=0x104800000, sport=<value temporarily unavailable, due to optimizations>, dstHost=0x10193b400, dport=<value temporarily unavailable, due to optimizations>, sent_length=1500, rcvd_length=0, tp=0x102f7e5e0, packetDataLength=1460, packetData=0x102f7eaf6 "..."..., actualDeviceId=0, newSession=0x102f7e67a, real_session=1 '\001') at sessions.c:2587 #2 0x00000001000c84f9 in processIpPkt (bp=<value temporarily unavailable, due to optimizations>, h=0x102f80e40, length=1514, ether_src=0x102f7e876 "", ether_dst=0x102f7e870 "\002?RT?\017", actualDeviceId=0, vlanId=65535) at pbuf.c:1682 #3 0x00000001000cc9b8 in processPacket (_deviceId=<value temporarily unavailable, due to optimizations>, h=0x102f80e40, p=0x102f7eac0 "\002?RT?\017") at pbuf.c:3742 #4 0x00000001000d00bf in queuePacket (_deviceId=<value temporarily unavailable, due to optimizations>, h=0x102f80e40, p=0x101898800 "\002?RT?\017") at pbuf.c:2537 #5 0x000000010155a697 in pcap_offline_read () #6 0x00000001000bbd29 in pcapDispatch (_i=0x0) at ntop.c:96 #7 0x00007fff80841456 in _pthread_start () #8 0x00007fff80841309 in thread_start () (gdb) With execution terminating after the following console outputs: Mon Oct 11 14:37:57 2010 Now running as requested user '<unknown>' (58328:20) Mon Oct 11 14:37:57 2010 Note: Reporting device initally set to 0 [sbs-tcpdump-2010-10-09.cap] (merged) Mon Oct 11 14:37:57 2010 THREADMGMT[t140735073668128]: ntop RUNSTATE: RUN(4) Mon Oct 11 14:37:57 2010 THREADMGMT[t4354215936]: NPS(1): Started thread for network packet sniffing [pcap-file] Mon Oct 11 14:37:57 2010 THREADMGMT[t4354215936]: NPS(sbs-tcpdump-2010-10-09.cap): pcapDispatch thread starting [p8893] Mon Oct 11 14:37:57 2010 THREADMGMT[t4354215936]: NPS(sbs-tcpdump-2010-10-09.cap): pcapDispatch thread running [p8893] Mon Oct 11 14:37:57 2010 THREADMGMT[t4339945472]: SFP: Fingerprint scan thread running [p8893] Mon Oct 11 14:37:57 2010 THREADMGMT[t4340482048]: SIH: Idle host scan thread running [p8893] The problem does not occur if the --known-subnets option is removed. Although I cannot share the libpcap file involved due to its sensitive content, I would like to help resolve this problem. Please let me know what I can do to help. Best Regards, Matthew Hall. _______________________________________________ Ntop-dev mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-dev
