GNU gdb (GDB) Red Hat Enterprise Linux 7.6.1-115.el7 Copyright (C) 2013 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". For bug reporting instructions, please see: ... Reading symbols from /usr/sbin/suricata...Reading symbols from /usr/lib/debug/usr/sbin/suricata.debug...done. done. [New LWP 4747] [New LWP 4695] [New LWP 4766] [New LWP 4763] [New LWP 4765] [New LWP 4760] [New LWP 4764] [New LWP 4767] [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib64/libthread_db.so.1". Core was generated by `/sbin/suricata -c /etc/suricata/cluster1.yaml --pidfile /var/run/suricata/clust'. Program terminated with signal 11, Segmentation fault. #0 0x00005629a7abbc08 in StorageGetById (storage=storage@entry=0x128, type=type@entry=STORAGE_FLOW, id=1) at util-storage.c:224 224 return storage[id]; Missing separate debuginfos, use: debuginfo-install hiredis-0.12.1-1.el7.x86_64 (gdb) Thread 8 (Thread 0x7f9b57d88700 (LWP 4767)): #0 0x00007f9b5d726953 in select () at ../sysdeps/unix/syscall-template.S:81 No locals. #1 0x00005629a7a80c97 in UnixMain (this=0x5629a80e5240 ) at unix-manager.c:650 tv = {tv_sec = 0, tv_usec = 134763} ret = tclient = select_set = {fds_bits = {16384, 0 }} uclient = 0x0 #2 UnixManager (th_v=0x5629ad9f6e60, thread_data=) at unix-manager.c:1125 __FUNCTION__ = "UnixManager" #3 0x00005629a7a7d77d in TmThreadsManagement (td=0x5629ad9f6e60) at tm-threads.c:541 tv = 0x5629ad9f6e60 s = 0x5629aa6cce10 r = __PRETTY_FUNCTION__ = "TmThreadsManagement" __FUNCTION__ = "TmThreadsManagement" #4 0x00007f9b5de20e65 in start_thread (arg=0x7f9b57d88700) at pthread_create.c:307 __res = pd = 0x7f9b57d88700 now = unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140305170466560, -3648906053108875441, 0, 8392704, 0, 140305170466560, 3632950210833694543, 3632927718736543567}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}} not_first_call = pagesize_m1 = sp = freesize = #5 0x00007f9b5d72f88d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111 No locals. Thread 7 (Thread 0x7f9b5958b700 (LWP 4764)): #0 0x00007f9b5d6f680d in nanosleep () at ../sysdeps/unix/syscall-template.S:81 No locals. #1 0x00007f9b5d7270e4 in usleep (useconds=useconds@entry=100) at ../sysdeps/unix/sysv/linux/usleep.c:32 ts = {tv_sec = 0, tv_nsec = 100000} #2 0x00005629a7a218d4 in FlowRecycler (th_v=0x5629afcb6830, thread_data=0x7f9b3c0008c0) at flow-manager.c:1210 list = {top = 0x0, bot = 0x0, len = 0} bail = 0 f = 0x0 ts = {tv_sec = 1604508512, tv_usec = 440172} recycled_cnt = 13494 ftd = 0x7f9b3c0008c0 __PRETTY_FUNCTION__ = "FlowRecycler" fr_passes = startts = {tv_sec = 1604501420, tv_usec = 272447} __FUNCTION__ = "FlowRecycler" #3 0x00005629a7a7d77d in TmThreadsManagement (td=0x5629afcb6830) at tm-threads.c:541 tv = 0x5629afcb6830 s = 0x5629b13b1990 r = __PRETTY_FUNCTION__ = "TmThreadsManagement" __FUNCTION__ = "TmThreadsManagement" #4 0x00007f9b5de20e65 in start_thread (arg=0x7f9b5958b700) at pthread_create.c:307 __res = pd = 0x7f9b5958b700 now = unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140305195644672, -3648906053108875441, 0, 8392704, 0, 140305195644672, 3632938109226467151, 3632927718736543567}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}} not_first_call = pagesize_m1 = sp = freesize = #5 0x00007f9b5d72f88d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111 No locals. Thread 6 (Thread 0x7f9b5a83c700 (LWP 4760)): #0 0x00007f9b5d6f680d in nanosleep () at ../sysdeps/unix/syscall-template.S:81 No locals. #1 0x00007f9b5d7270e4 in usleep (useconds=) at ../sysdeps/unix/sysv/linux/usleep.c:32 ts = {tv_sec = 0, tv_nsec = 1000} #2 0x00007f9b5ff5256a in pfring_mod_zc_spsc_poll () from /usr/lib/libpfring.so.7 No symbol table info available. #3 0x00007f9b5ff527ce in pfring_mod_zc_spsc_recv () from /usr/lib/libpfring.so.7 No symbol table info available. #4 0x00007f9b5ff3edf0 in pfring_recv () from /usr/lib/libpfring.so.7 No symbol table info available. #5 0x00005629a7a66d74 in ReceivePfringLoop (tv=0x5629aacfda70, data=, slot=) at source-pfring.c:390 r = ptv = p = 0x7f9b4426ff00 hdr = {ts = {tv_sec = 0, tv_usec = 0}, caplen = 110, len = 110, extended_hdr = {timestamp_ns = 1604508512346089965, flags = 0, rx_direction = 1 '\001', port_id = 0 '\000', device_id = 0, if_index = 1518582320, pkt_hash = 1476483073, tx = {bounce_interface = -1372793280, reserved = 0x5629aacfdb30}, parsed_pkt = {dmac = "\000ǃZ\233\177", smac = "\000\000\334jk]", eth_type = 32667, vlan_id = 0, qinq_vlan_id = 47664, ip_version = 131 '\203', l3_proto = 90 'Z', ip_tos = 155 '\233', ip_src = {v6 = {__in6_u = { __u6_addr8 = "\177\000\000(\000\000\000\000\000\000\000\060\031tL\233", __u6_addr16 = {127, 10240, 0, 0, 0, 12288, 29721, 39756}, __u6_addr32 = {671088767, 0, 805306368, 2605478937}}}, v4 = 671088767}, ip_dst = {v6 = {__in6_u = {__u6_addr8 = "\177\000\000-~\252\247)V\000\000@m1\251)", __u6_addr16 = {127, 11520, 43646, 10663, 86, 16384, 12653, 10665}, __u6_addr32 = {754974847, 698854014, 1073741910, 698954093}}}, v4 = 754974847}, l4_src_port = 86, l4_dst_port = 12288, icmp_type = 186 '\272', icmp_code = 131 '\203', tcp = {flags = 90 'Z', seq_num = 0, ack_num = 0}, tunnel = {tunnel_id = 2593041664, tunneled_ip_version = 167 '\247', tunneled_proto = 41 ')', tunneled_ip_src = {v6 = {__in6_u = { __u6_addr8 = "V\000\000\000\000\203Z\233\177\000\000\300x\016\250)", __u6_addr16 = {86, 0, 33536, 39770, 127, 49152, 3704, 10664}, __u6_addr32 = {86, 2606400256, 3221225599, 698879608}}}, v4 = 86}, tunneled_ip_dst = {v6 = {__in6_u = {__u6_addr8 = "V\000\000\000\020\200\000\000\000\000\000\000N\253\\\267", __u6_addr16 = {86, 0, 32784, 0, 0, 0, 43854, 46940}, __u6_addr32 = {86, 32784, 0, 3076303694}}}, v4 = 86}, tunneled_l4_src_port = 26947, tunneled_l4_dst_port = 28724}, last_matched_rule_id = 699060186, offset = {eth_offset = 86, vlan_offset = 12288, l3_offset = -12325, l4_offset = 10666, payload_offset = 86}}}} s = last_dump = 1604508512 buffer_size = pkt_buffer = 0x0 rc = __FUNCTION__ = "ReceivePfringLoop" #6 0x00005629a7a7db5e in TmThreadsSlotPktAcqLoop (td=0x5629aacfda70) at tm-threads.c:312 tv = 0x5629aacfda70 s = 0x5629b208ec50 run = 1 '\001' r = slot = __FUNCTION__ = "TmThreadsSlotPktAcqLoop" #7 0x00007f9b5de20e65 in start_thread (arg=0x7f9b5a83c700) at pthread_create.c:307 __res = pd = 0x7f9b5a83c700 now = unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140305215244032, -3648906053108875441, 0, 8392704, 0, 140305215244032, 3632942825637429071, 3632927718736543567}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}} not_first_call = pagesize_m1 = sp = freesize = #8 0x00007f9b5d72f88d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111 No locals. Thread 5 (Thread 0x7f9b58d8a700 (LWP 4765)): #0 pthread_cond_timedwait@@GLIBC_2.3.2 () at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_timedwait.S:238 No locals. #1 0x00005629a79a8a37 in StatsWakeupThread (arg=0x5629ad9f6760) at counters.c:487 cur_timev = {tv_sec = 1604508512, tv_usec = 407256} cond_time = {tv_sec = 1604508515, tv_nsec = 407256000} tv = tv_local = 0x5629ad9f6760 __FUNCTION__ = "StatsWakeupThread" #2 0x00007f9b5de20e65 in start_thread (arg=0x7f9b58d8a700) at pthread_create.c:307 __res = pd = 0x7f9b58d8a700 now = unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140305187251968, -3648906053108875441, 0, 8392704, 0, 140305187251968, 3632939208201224015, 3632927718736543567}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}} not_first_call = pagesize_m1 = sp = freesize = #3 0x00007f9b5d72f88d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111 No locals. Thread 4 (Thread 0x7f9b59d8c700 (LWP 4763)): #0 0x00007f9b5d6f680d in nanosleep () at ../sysdeps/unix/syscall-template.S:81 No locals. #1 0x00007f9b5d7270e4 in usleep (useconds=useconds@entry=100) at ../sysdeps/unix/sysv/linux/usleep.c:32 ts = {tv_sec = 0, tv_nsec = 100000} #2 0x00005629a7a222a9 in FlowManager (th_v=0x5629ae852df0, thread_data=0x7f9b480008c0) at flow-manager.c:1014 ts_ms = 1604508512440 rt = 1604508512 emerge_p = ftd = 0x7f9b480008c0 ts = {tv_sec = 1604508512, tv_usec = 440125} emerg = false prev_emerg = false other_last_sec = 1604508512 flow_last_sec = 1604508511 hash_passes = hash_row_checks = hash_passes_chunks = hash_full_passes = pass_in_sec = 240 startts = {tv_sec = 1604501420, tv_usec = 271462} hash_pass_iter = 131 emerg_over_cnt = 0 next_run_ms = 1604508512539 __FUNCTION__ = "FlowManager" #3 0x00005629a7a7d77d in TmThreadsManagement (td=0x5629ae852df0) at tm-threads.c:541 tv = 0x5629ae852df0 s = 0x5629b1068dd0 r = __PRETTY_FUNCTION__ = "TmThreadsManagement" __FUNCTION__ = "TmThreadsManagement" #4 0x00007f9b5de20e65 in start_thread (arg=0x7f9b59d8c700) at pthread_create.c:307 __res = pd = 0x7f9b59d8c700 now = unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140305204037376, -3648906053108875441, 0, 8392704, 0, 140305204037376, 3632937010251710287, 3632927718736543567}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}} not_first_call = pagesize_m1 = sp = freesize = #5 0x00007f9b5d72f88d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111 No locals. Thread 3 (Thread 0x7f9b58589700 (LWP 4766)): #0 pthread_cond_timedwait@@GLIBC_2.3.2 () at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_timedwait.S:238 No locals. #1 0x00005629a79a90e0 in StatsMgmtThread (arg=0x5629ad9f6ae0) at counters.c:415 cur_timev = {tv_sec = 1604508508, tv_usec = 788793} cond_time = {tv_sec = 1604508516, tv_nsec = 788793000} tv_local = 0x5629ad9f6ae0 __FUNCTION__ = "StatsMgmtThread" __PRETTY_FUNCTION__ = "StatsMgmtThread" r = #2 0x00007f9b5de20e65 in start_thread (arg=0x7f9b58589700) at pthread_create.c:307 __res = pd = 0x7f9b58589700 now = unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140305178859264, -3648906053108875441, 0, 8392704, 0, 140305178859264, 3632940307175980879, 3632927718736543567}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}} not_first_call = pagesize_m1 = sp = freesize = #3 0x00007f9b5d72f88d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111 No locals. Thread 2 (Thread 0x7f9b61bc6b00 (LWP 4695)): #0 0x00007f9b5d6f680d in nanosleep () at ../sysdeps/unix/syscall-template.S:81 No locals. #1 0x00007f9b5d7270e4 in usleep (useconds=useconds@entry=10000) at ../sysdeps/unix/sysv/linux/usleep.c:32 ts = {tv_sec = 0, tv_nsec = 10000000} #2 0x00005629a7a79c67 in SuricataMainLoop (suri=) at suricata.c:2660 No locals. #3 SuricataMain (argc=, argv=) at suricata.c:2821 vlan_tracking = 1 __FUNCTION__ = "SuricataMain" #4 0x00007f9b5d653505 in __libc_start_main (main=0x5629a7976b20
, argc=6, argv=0x7ffe28ea2b18, init=, fini=, rtld_fini=, stack_end=0x7ffe28ea2b08) at ../csu/libc-start.c:266 result = unwind_buf = {cancel_jmp_buf = {{jmp_buf = {0, -3648906053108875441, 94736905366309, 140729584855824, 0, 0, 3647962510380515151, 3632928862588256079}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x7f9b619cf973 <_dl_init+275>, 0x7f9b61be3150}, data = {prev = 0x0, cleanup = 0x0, canceltype = 1637677427}}} not_first_call = #5 0x00005629a7976b4e in _start () No symbol table info available. Thread 1 (Thread 0x7f9b5b2ec700 (LWP 4747)): #0 0x00005629a7abbc08 in StorageGetById (storage=storage@entry=0x128, type=type@entry=STORAGE_FLOW, id=1) at util-storage.c:224 No locals. #1 0x00005629a7a23513 in FlowGetStorageById (f=f@entry=0x0, id=) at flow-storage.c:41 No locals. #2 0x00005629a7a4eccf in EveAddCommonOptions (cfg=cfg@entry=0x5629aa1b4230, p=p@entry=0x7f9b4c26ff00, f=, js=js@entry=0x7f9b4c74a180) at output-json.c:451 ms = #3 0x00005629a7a35ec1 in AlertJson (aft=aft@entry=0x7f9b4c5b81e0, p=p@entry=0x7f9b4c26ff00, tv=) at output-json-alert.c:622 xff_cfg = 0x5629aa1b3c80 have_xff_ip = 0 jb = 0x7f9b4c74a180 pa = 0x7f9b4c2700b8 addr = {src_ip = "91.203.165.166", '\000' , dst_ip = "95.130.232.214", '\000' , sp = 0, dp = 0, proto = "TCP", '\000' } xff_buffer = "\354\254\020\252)V\000\000 \000\000L\233\177\000\000\001\000\000\000\000\000\000\000\240\020\000\000\000\000\000\000\070\000\000\000\000\000\000\000`/uL\233\177" i = 0 payload = 0x7f9b4c5c8230 json_output_ctx = 0x5629aa1b4210 #4 0x00005629a7a36d59 in JsonAlertLogger (tv=, thread_data=0x7f9b4c5b81e0, p=0x7f9b4c26ff00) at output-json-alert.c:767 aft = 0x7f9b4c5b81e0 #5 0x00005629a7a4b72c in OutputPacketLog (tv=0x5629ae852a70, p=0x7f9b4c26ff00, thread_data=) at output-packet.c:116 op_thread_data = logger = 0x5629aa1b42f0 store = 0x7f9b4c5c93c0 #6 0x00005629a7a32294 in OutputLoggerLog (tv=tv@entry=0x5629ae852a70, p=p@entry=0x7f9b4c26ff00, thread_data=) at output.c:882 thread_store = logger = 0x5629aa1b5b40 thread_store_node = 0x7f9b4c5c9420 #7 0x00005629a7a256a0 in FlowWorker (tv=0x5629ae852a70, p=0x7f9b4c26ff00, data=0x7f9b4c3fc740) at flow-worker.c:545 fw = 0x7f9b4c3fc740 detect_thread = 0x7f9b4c4cec00 #8 0x00005629a7a7c2ce in TmThreadsSlotVarRun (tv=tv@entry=0x5629ae852a70, p=p@entry=0x7f9b4c26ff00, slot=) at tm-threads.c:117 r = s = 0x5629aa67c200 #9 0x00005629a7a66ea1 in TmThreadsSlotProcessPkt (p=0x7f9b4c26ff00, s=, tv=0x5629ae852a70) at tm-threads.h:192 r = #10 ReceivePfringLoop (tv=0x5629ae852a70, data=, slot=) at source-pfring.c:415 r = ptv = p = 0x7f9b4c26ff00 hdr = {ts = {tv_sec = 1604508512, tv_usec = 428319}, caplen = 60, len = 60, extended_hdr = {timestamp_ns = 1604508512428319571, flags = 0, rx_direction = 1 '\001', port_id = 0 '\000', device_id = 0, if_index = 1529788976, pkt_hash = 2995040900, tx = {bounce_interface = -1423068992, reserved = 0x5629ae852b30}, parsed_pkt = {dmac = "\000\307.[\233\177", smac = "\000\000\334jk]", eth_type = 32667, vlan_id = 0, qinq_vlan_id = 45216, ip_version = 115 's', l3_proto = 76 'L', ip_tos = 155 '\233', ip_src = {v6 = {__in6_u = {__u6_addr8 = "\177\000\000(\000\000\000\000\000\000\000\060\031tL\233", __u6_addr16 = {127, 10240, 0, 0, 0, 12288, 29721, 39756}, __u6_addr32 = {671088767, 0, 805306368, 2605478937}}}, v4 = 671088767}, ip_dst = {v6 = {__in6_u = { __u6_addr8 = "\177\000\000-~\252\247)V\000\000\060\272.[\233", __u6_addr16 = {127, 11520, 43646, 10663, 86, 12288, 11962, 39771}, __u6_addr32 = {754974847, 698854014, 805306454, 2606444218}}}, v4 = 754974847}, l4_src_port = 127, l4_dst_port = 49152, icmp_type = 176 '\260', icmp_code = 45 '-', tcp = {flags = 171 '\253', seq_num = 0, ack_num = 0}, tunnel = { tunnel_id = 2593041664, tunneled_ip_version = 167 '\247', tunneled_proto = 41 ')', tunneled_ip_src = {v6 = {__in6_u = {__u6_addr8 = "V\000\000\000\000.[\233\177\000\000\300x\016\250)", __u6_addr16 = {86, 0, 11776, 39771, 127, 49152, 3704, 10664}, __u6_addr32 = {86, 2606444032, 3221225599, 698879608}}}, v4 = 86}, tunneled_ip_dst = {v6 = {__in6_u = { __u6_addr8 = "V\000\000\000\020\200\000\000\000\000\000\000N\253\\\267", __u6_addr16 = {86, 0, 32784, 0, 0, 0, 43854, 46940}, __u6_addr32 = {86, 32784, 0, 3076303694}}}, v4 = 86}, tunneled_l4_src_port = 26947, tunneled_l4_dst_port = 28724}, last_matched_rule_id = 699303210, offset = {eth_offset = 86, vlan_offset = 12288, l3_offset = -31445, l4_offset = 10670, payload_offset = 86}}}} s = last_dump = 1604508512 buffer_size = pkt_buffer = 0x2aaaae748240
rc = __FUNCTION__ = "ReceivePfringLoop" #11 0x00005629a7a7db5e in TmThreadsSlotPktAcqLoop (td=0x5629ae852a70) at tm-threads.c:312 tv = 0x5629ae852a70 s = 0x5629aadd6080 run = 1 '\001' r = slot = __FUNCTION__ = "TmThreadsSlotPktAcqLoop" #12 0x00007f9b5de20e65 in start_thread (arg=0x7f9b5b2ec700) at pthread_create.c:307 __res = pd = 0x7f9b5b2ec700 now = unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140305226450688, -3648906053108875441, 0, 8392704, 0, 140305226450688, 3632941562917044047, 3632927718736543567}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}} not_first_call = pagesize_m1 = sp = freesize = #13 0x00007f9b5d72f88d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111 No locals. (gdb) quit