Thread 72 (Thread 0x7fc23f7fe700 (LWP 58684)): #0 0x00000000006603d6 in StreamTcpSessionClear (ssnptr=0x7fb50418f170) at stream-tcp.c:259 #1 0x000000000060798e in FlowClearMemory (f=0x7fc6d94a2170, proto_map=0 '\000') at flow.c:1077 #2 0x000000000060d551 in Recycler (tv=0x7fc6ba47fec0, output_thread_data=0x7fc228000b80, f=0x7fc6d94a2170) at flow-manager.c:590 #3 0x000000000060c3ca in FlowRecycler (th_v=0x7fc6ba47fec0, thread_data=0x7fc228000b60) at flow-manager.c:1142 #4 0x00000000005071e6 in TmThreadsManagement (td=0x7fc6ba47fec0) at tm-threads.c:552 #5 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #6 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 71 (Thread 0x7fc58975b700 (LWP 58636)): #0 DetectRulePacketRules (tv=0x7fc69dab0fa0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc543882740, p=0x7fc54e4ff660, pflow=0x7fc6bde4d000, scratch=0x7fc58975a6f0) at detect.c:774 #1 0x00000000006f1d1e in DetectRun (th_v=0x7fc69dab0fa0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc543882740, p=0x7fc54e4ff660) at detect.c:136 #2 0x00000000006f19ff in DetectFlow (tv=0x7fc69dab0fa0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc543882740, p=0x7fc54e4ff660) at detect.c:1681 #3 0x00000000006f18a8 in Detect (tv=0x7fc69dab0fa0, p=0x7fc54e4ff660, data=0x7fc543882740) at detect.c:1753 #4 0x0000000000611758 in FlowWorker (tv=0x7fc69dab0fa0, p=0x7fc54e4ff660, data=0x7fc54e53b0f0) at flow-worker.c:552 #5 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc69dab0fa0, p=0x7fc54e4ff660, slot=0x7fc6a3640760) at tm-threads.c:117 #6 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc69dab0fa0, s=0x7fc6a3640760, p=0x7fc54e4ff660) at ./tm-threads.h:195 #7 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc557fff680, pbd=0x7fc004000000, ppd=0x7fc004090ed0) at source-af-packet.c:983 #8 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc557fff680, pbd=0x7fc004000000) at source-af-packet.c:996 #9 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc557fff680) at source-af-packet.c:1043 #10 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc69dab0fa0, data=0x7fc557fff680, slot=0x7fc6b78c6270) at source-af-packet.c:1393 #11 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc69dab0fa0) at tm-threads.c:312 #12 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #13 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 70 (Thread 0x7fc2d7a74700 (LWP 58674)): #0 __GI___libc_free (mem=0x7fb372f76cd0) at malloc.c:3093 #1 0x0000000000556913 in SSLStateFree (p=0x7fb372f76cd0) at app-layer-ssl.c:2742 #2 0x000000000054fd8b in AppLayerParserStateProtoCleanup (protomap=0 '\000', alproto=4, alstate=0x7fb372f76cd0, pstate=0x7fb9e0173780) at app-layer-parser.c:1543 #3 0x000000000054fdf1 in AppLayerParserStateCleanup (f=0x7fc6d5dd6820, alstate=0x7fb372f76cd0, pstate=0x7fb9e0173780) at app-layer-parser.c:1554 #4 0x00000000006049ec in FlowCleanupAppLayer (f=0x7fc6d5dd6820) at flow.c:147 #5 0x00000000006079a0 in FlowClearMemory (f=0x7fc6d5dd6820, proto_map=0 '\000') at flow.c:1082 #6 0x0000000000612119 in CheckWorkQueue (tv=0x7fc6ba5d9640, fw=0x7fc2ca53b0f0, detect_thread=0x7fc2bf882740, counters=0x7fc2d7a73768, fq=0x7fc2d7a73790) at flow-worker.c:192 #7 0x0000000000611ed9 in FlowWorkerProcessInjectedFlows (tv=0x7fc6ba5d9640, fw=0x7fc2ca53b0f0, p=0x7fc2ca4ff660, detect_thread=0x7fc2bf882740) at flow-worker.c:460 #8 0x000000000061189b in FlowWorker (tv=0x7fc6ba5d9640, p=0x7fc2ca4ff660, data=0x7fc2ca53b0f0) at flow-worker.c:590 #9 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba5d9640, p=0x7fc2ca4ff660, slot=0x7fc69ff950c0) at tm-threads.c:117 #10 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba5d9640, s=0x7fc69ff950c0, p=0x7fc2ca4ff660) at ./tm-threads.h:195 #11 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc2cffff680, pbd=0x7fbbd5200000, ppd=0x7fbbd52cc960) at source-af-packet.c:983 #12 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc2cffff680, pbd=0x7fbbd5200000) at source-af-packet.c:996 #13 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc2cffff680) at source-af-packet.c:1043 #14 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba5d9640, data=0x7fc2cffff680, slot=0x7fc6b81b2a20) at source-af-packet.c:1393 #15 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba5d9640) at tm-threads.c:312 #16 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #17 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 69 (Thread 0x7fc23ffff700 (LWP 58683)): #0 0x000000000060c5b7 in RemoveFromHash (f=0x7fb534ab6270, prev_f=0x0) at ./flow-hash.h:90 #1 0x000000000060cecd in FlowManagerHashRowTimeout (td=0x7fc238000b90, f=0x7fb534ab6270, ts=0x7fc23fffeab0, emergency=0, counters=0x7fc23fffe9f0, next_ts=0x7fc23fffe894) at flow-manager.c:367 #2 0x000000000060cb8a in FlowTimeoutHash (td=0x7fc238000b90, ts=0x7fc23fffeab0, hash_min=5133289, hash_max=5149955, counters=0x7fc23fffe9f0) at flow-manager.c:451 #3 0x000000000060cd7c in FlowTimeoutHashInChunks (td=0x7fc238000b90, ts=0x7fc23fffeab0, hash_min=4000001, hash_max=8000000, counters=0x7fc23fffe9f0, iter=68, chunks=240) at flow-manager.c:504 #4 0x000000000060bb76 in FlowManager (th_v=0x7fc6ba429030, thread_data=0x7fc238000b60) at flow-manager.c:853 #5 0x00000000005071e6 in TmThreadsManagement (td=0x7fc6ba429030) at tm-threads.c:552 #6 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #7 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 68 (Thread 0x7fc29175b700 (LWP 58681)): #0 0x00000000006f2735 in DetectRulePacketRules (tv=0x7fc6ba6651c0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc24b882740, p=0x7fc2564ff660, pflow=0x7fb9201e3c00, scratch=0x7fc29175a6f0) at detect.c:754 #1 0x00000000006f1d1e in DetectRun (th_v=0x7fc6ba6651c0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc24b882740, p=0x7fc2564ff660) at detect.c:136 #2 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba6651c0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc24b882740, p=0x7fc2564ff660) at detect.c:1681 #3 0x00000000006f18a8 in Detect (tv=0x7fc6ba6651c0, p=0x7fc2564ff660, data=0x7fc24b882740) at detect.c:1753 #4 0x0000000000611758 in FlowWorker (tv=0x7fc6ba6651c0, p=0x7fc2564ff660, data=0x7fc25653b0f0) at flow-worker.c:552 #5 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba6651c0, p=0x7fc2564ff660, slot=0x7fc6b341dd90) at tm-threads.c:117 #6 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba6651c0, s=0x7fc6b341dd90, p=0x7fc2564ff660) at ./tm-threads.h:195 #7 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc25ffff680, pbd=0x7fbaffa00000, ppd=0x7fbaffa432b8) at source-af-packet.c:983 #8 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc25ffff680, pbd=0x7fbaffa00000) at source-af-packet.c:996 #9 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc25ffff680) at source-af-packet.c:1043 #10 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba6651c0, data=0x7fc25ffff680, slot=0x7fc6bbfece90) at source-af-packet.c:1393 #11 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba6651c0) at tm-threads.c:312 #12 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #13 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 67 (Thread 0x7fc36fa74700 (LWP 58665)): #0 DetectRulePacketRules (tv=0x7fc6ba767c70, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc357882740, p=0x7fc3624ff660, pflow=0x7fc6bd17f430, scratch=0x7fc36fa736f0) at detect.c:756 #1 0x00000000006f1d1e in DetectRun (th_v=0x7fc6ba767c70, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc357882740, p=0x7fc3624ff660) at detect.c:136 #2 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba767c70, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc357882740, p=0x7fc3624ff660) at detect.c:1681 #3 0x00000000006f18a8 in Detect (tv=0x7fc6ba767c70, p=0x7fc3624ff660, data=0x7fc357882740) at detect.c:1753 #4 0x0000000000611758 in FlowWorker (tv=0x7fc6ba767c70, p=0x7fc3624ff660, data=0x7fc36253b0f0) at flow-worker.c:552 #5 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba767c70, p=0x7fc3624ff660, slot=0x7fc6b3f53740) at tm-threads.c:117 #6 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba767c70, s=0x7fc6b3f53740, p=0x7fc3624ff660) at ./tm-threads.h:195 #7 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc367fff680, pbd=0x7fbccca00000, ppd=0x7fbcccab32f8) at source-af-packet.c:983 #8 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc367fff680, pbd=0x7fbccca00000) at source-af-packet.c:996 #9 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc367fff680) at source-af-packet.c:1043 #10 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba767c70, data=0x7fc367fff680, slot=0x7fc6b3f56170) at source-af-packet.c:1393 #11 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba767c70) at tm-threads.c:312 #12 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #13 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 66 (Thread 0x7fc23d7fa700 (LWP 58688)): #0 0x00007fc82fde212b in __GI___select (nfds=7, readfds=0x7fc23d7f99e8, writefds=0x0, exceptfds=0x0, timeout=0x7fc23d7f9a70) at ../sysdeps/unix/sysv/linux/select.c:41 #1 0x0000000000509642 in UnixMain (this=0xd2c8d0 ) at unix-manager.c:650 #2 0x000000000050925c in UnixManager (th_v=0x7fc6aef4fb80, thread_data=0x7fc224000b60) at unix-manager.c:1125 #3 0x00000000005071e6 in TmThreadsManagement (td=0x7fc6aef4fb80) at tm-threads.c:552 #4 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #5 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 65 (Thread 0x7fc5cfa74700 (LWP 58629)): #0 0x0000000000571d99 in DecodeTCPOptions (p=0x7fc5c24ff660, pkt=0x7fc0df434700 , pktlen=20) at decode-tcp.c:64 #1 0x0000000000571c8e in DecodeTCPPacket (tv=0x7fc6bba1b7c0, p=0x7fc5c24ff660, pkt=0x7fc0df4346dc , len=40) at decode-tcp.c:237 #2 0x0000000000571993 in DecodeTCP (tv=0x7fc6bba1b7c0, dtv=0x7fc5c7fffcc0, p=0x7fc5c24ff660, pkt=0x7fc0df4346dc , len=40) at decode-tcp.c:256 #3 0x000000000056ad6d in DecodeIPV4 (tv=0x7fc6bba1b7c0, dtv=0x7fc5c7fffcc0, p=0x7fc5c24ff660, pkt=0x7fc0df4346c8 , len=75) at decode-ipv4.c:562 #4 0x00000000005739dc in DecodeNetworkLayer (tv=0x7fc6bba1b7c0, dtv=0x7fc5c7fffcc0, proto=2048, p=0x7fc5c24ff660, data=0x7fc0df4346c8 , len=75) at ./decode.h:1299 #5 0x0000000000573713 in DecodeVLAN (tv=0x7fc6bba1b7c0, dtv=0x7fc5c7fffcc0, p=0x7fc5c24ff660, pkt=0x7fc0df4346c4 , len=79) at decode-vlan.c:94 #6 0x000000000056a1c1 in DecodeNetworkLayer (tv=0x7fc6bba1b7c0, dtv=0x7fc5c7fffcc0, proto=33024, p=0x7fc5c24ff660, data=0x7fc0df4346c4 , len=79) at ./decode.h:1319 #7 0x0000000000569e6f in DecodeEthernet (tv=0x7fc6bba1b7c0, dtv=0x7fc5c7fffcc0, p=0x7fc5c24ff660, pkt=0x7fc0df4346b6 , len=93) at decode-ethernet.c:61 #8 0x0000000000659463 in DecodeLinkLayer (tv=0x7fc6bba1b7c0, dtv=0x7fc5c7fffcc0, datalink=1, p=0x7fc5c24ff660, data=0x7fc0df4346b6 , len=93) at ./decode.h:1266 #9 0x00000000006540a3 in DecodeAFP (tv=0x7fc6bba1b7c0, p=0x7fc5c24ff660, data=0x7fc5c7fffcc0) at source-af-packet.c:2710 #10 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6bba1b7c0, p=0x7fc5c24ff660, slot=0x7fc69f467850) at tm-threads.c:117 #11 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6bba1b7c0, s=0x7fc69f467850, p=0x7fc5c24ff660) at ./tm-threads.h:195 #12 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc5c7fff680, pbd=0x7fc0df400000, ppd=0x7fc0df434660) at source-af-packet.c:983 #13 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc5c7fff680, pbd=0x7fc0df400000) at source-af-packet.c:996 #14 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc5c7fff680) at source-af-packet.c:1043 #15 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6bba1b7c0, data=0x7fc5c7fff680, slot=0x7fc6a6911b60) at source-af-packet.c:1393 #16 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6bba1b7c0) at tm-threads.c:312 #17 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #18 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 64 (Thread 0x7fc23e7fc700 (LWP 58686)): #0 futex_abstimed_wait_cancelable (private=, abstime=0x7fc23e7fbb18, clockid=, expected=0, futex_word=0x7fc6992ac278) at ../sysdeps/nptl/futex-internal.h:320 #1 __pthread_cond_wait_common (abstime=0x7fc23e7fbb18, clockid=, mutex=0x7fc699238a80, cond=0x7fc6992ac250) at pthread_cond_wait.c:520 #2 __pthread_cond_timedwait (cond=0x7fc6992ac250, mutex=0x7fc699238a80, abstime=0x7fc23e7fbb18) at pthread_cond_wait.c:656 #3 0x000000000056112c in StatsWakeupThread (arg=0x7fc6ba4dd4f0) at counters.c:487 #4 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #5 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 63 (Thread 0x7fc2d5f5c700 (LWP 58676)): #0 0x000000000058d5c2 in DetectEnginePktInspectionRun (tv=0x7fc6bc3baa40, det_ctx=0x7fc29f882740, s=0x7fc6bcef5050, f=0x7fb1d4314f90, p=0x7fc2aa4ff660, alert_flags=0x7fc2d5f5b677 "") at detect-engine.c:1814 #1 0x00000000006f28b6 in DetectRulePacketRules (tv=0x7fc6bc3baa40, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc29f882740, p=0x7fc2aa4ff660, pflow=0x7fb1d4314f90, scratch=0x7fc2d5f5b6f0) at detect.c:796 #2 0x00000000006f1d1e in DetectRun (th_v=0x7fc6bc3baa40, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc29f882740, p=0x7fc2aa4ff660) at detect.c:136 #3 0x00000000006f19ff in DetectFlow (tv=0x7fc6bc3baa40, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc29f882740, p=0x7fc2aa4ff660) at detect.c:1681 #4 0x00000000006f18a8 in Detect (tv=0x7fc6bc3baa40, p=0x7fc2aa4ff660, data=0x7fc29f882740) at detect.c:1753 #5 0x0000000000611758 in FlowWorker (tv=0x7fc6bc3baa40, p=0x7fc2aa4ff660, data=0x7fc2aa53b0f0) at flow-worker.c:552 #6 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6bc3baa40, p=0x7fc2aa4ff660, slot=0x7fc6b81863b0) at tm-threads.c:117 #7 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6bc3baa40, s=0x7fc6b81863b0, p=0x7fc2aa4ff660) at ./tm-threads.h:195 #8 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc2b3fff680, pbd=0x7fbb92800000, ppd=0x7fbb92814968) at source-af-packet.c:983 #9 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc2b3fff680, pbd=0x7fbb92800000) at source-af-packet.c:996 #10 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc2b3fff680) at source-af-packet.c:1043 #11 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6bc3baa40, data=0x7fc2b3fff680, slot=0x7fc6a39af930) at source-af-packet.c:1393 #12 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6bc3baa40) at tm-threads.c:312 #13 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 62 (Thread 0x7fc32bfff700 (LWP 58669)): #0 0x00007fc82fd62bd2 in malloc_consolidate (av=av@entry=0x7fc320000020) at malloc.c:4486 #1 0x00007fc82fd64e03 in _int_malloc (av=av@entry=0x7fc320000020, bytes=bytes@entry=4096) at malloc.c:3699 #2 0x00007fc82fd67419 in __GI___libc_malloc (bytes=4096) at malloc.c:3066 #3 0x000000000088ae94 in alloc::alloc::alloc (layout=...) at /build/rustc-Nbf2Kl/rustc-1.53.0+dfsg1+llvm/library/alloc/src/alloc.rs:86 #4 alloc::alloc::Global::alloc_impl (self=, layout=..., zeroed=false) at /build/rustc-Nbf2Kl/rustc-1.53.0+dfsg1+llvm/library/alloc/src/alloc.rs:166 #5 ::allocate (self=, layout=...) at /build/rustc-Nbf2Kl/rustc-1.53.0+dfsg1+llvm/library/alloc/src/alloc.rs:226 #6 alloc::raw_vec::RawVec::allocate_in (capacity=4096, init=alloc::raw_vec::AllocInit::Uninitialized, alloc=...) at /build/rustc-Nbf2Kl/rustc-1.53.0+dfsg1+llvm/library/alloc/src/raw_vec.rs:195 #7 alloc::raw_vec::RawVec::with_capacity_in (capacity=4096, alloc=...) at /build/rustc-Nbf2Kl/rustc-1.53.0+dfsg1+llvm/library/alloc/src/raw_vec.rs:136 #8 alloc::vec::Vec::with_capacity_in (capacity=4096, alloc=...) at /build/rustc-Nbf2Kl/rustc-1.53.0+dfsg1+llvm/library/alloc/src/vec/mod.rs:580 #9 alloc::vec::Vec::with_capacity (capacity=4096) at /build/rustc-Nbf2Kl/rustc-1.53.0+dfsg1+llvm/library/alloc/src/vec/mod.rs:442 #10 alloc::string::String::with_capacity (capacity=4096) at /build/rustc-Nbf2Kl/rustc-1.53.0+dfsg1+llvm/library/alloc/src/string.rs:411 #11 suricata::jsonbuilder::JsonBuilder::new_object_with_capacity (capacity=4096) at src/jsonbuilder.rs:106 #12 suricata::jsonbuilder::JsonBuilder::new_object () at src/jsonbuilder.rs:102 #13 suricata::jsonbuilder::jb_new_object () at src/jsonbuilder.rs:622 #14 0x0000000000623cef in CreateEveHeader (p=0x7fc31e4fec10, dir=LOG_DIR_FLOW, event_type=0xb199ed "tls", addr=0x0, eve_ctx=0x7fc6bce13010) at output-json.c:840 #15 0x0000000000640429 in JsonTlsLogger (tv=0x7fc6bcbecad0, thread_data=0x7fc313dae280, p=0x7fc31e4fec10, f=0x7fb1e4d7be30, state=0x7fb239364700, txptr=0x7fb239364700, tx_id=0) at output-json-tls.c:404 #16 0x0000000000645e9b in OutputTxLog (tv=0x7fc6bcbecad0, p=0x7fc31e4fec10, thread_data=0x7fc313d6df80) at output-tx.c:296 #17 0x00000000006194f5 in OutputLoggerLog (tv=0x7fc6bcbecad0, p=0x7fc31e4fec10, thread_data=0x7fc313d4d600) at output.c:885 #18 0x0000000000612482 in FlowWorkerFlowTimeout (tv=0x7fc6bcbecad0, p=0x7fc31e4fec10, fw=0x7fc31e53b0f0, detect_thread=0x7fc313882740) at flow-worker.c:426 #19 0x00000000006123d8 in FlowFinish (tv=0x7fc6bcbecad0, f=0x7fb1e4d7be30, fw=0x7fc31e53b0f0, detect_thread=0x7fc313882740) at flow-worker.c:157 #20 0x000000000061208c in CheckWorkQueue (tv=0x7fc6bcbecad0, fw=0x7fc31e53b0f0, detect_thread=0x7fc313882740, counters=0x7fc32bffe768, fq=0x7fc32bffe790) at flow-worker.c:177 #21 0x0000000000611ed9 in FlowWorkerProcessInjectedFlows (tv=0x7fc6bcbecad0, fw=0x7fc31e53b0f0, p=0x7fc31e4ff660, detect_thread=0x7fc313882740) at flow-worker.c:460 #22 0x000000000061189b in FlowWorker (tv=0x7fc6bcbecad0, p=0x7fc31e4ff660, data=0x7fc31e53b0f0) at flow-worker.c:590 #23 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6bcbecad0, p=0x7fc31e4ff660, slot=0x7fc69eebb170) at tm-threads.c:117 #24 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6bcbecad0, s=0x7fc69eebb170, p=0x7fc31e4ff660) at ./tm-threads.h:195 #25 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc323fff680, pbd=0x7fbc49a00000, ppd=0x7fbc49b20f38) at source-af-packet.c:983 #26 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc323fff680, pbd=0x7fbc49a00000) at source-af-packet.c:996 #27 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc323fff680) at source-af-packet.c:1043 #28 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6bcbecad0, data=0x7fc323fff680, slot=0x7fc69f813930) at source-af-packet.c:1393 #29 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6bcbecad0) at tm-threads.c:312 #30 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #31 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 61 (Thread 0x7fc536ce8700 (LWP 58639)): #0 0x00007fc83066816b in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007fc83066ac25 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x00007fc83075552a in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #3 0x00007fc83065947b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #4 0x0000000000523e86 in SCHSSearch (mpm_ctx=0x7fc6997cd8f0, mpm_thread_ctx=0x7fc50f882828, pmq=0x7fc50f882858, buf=0x7fbfb2a0aac8 , buflen=1366) at util-mpm-hs.c:946 #5 0x00000000005a23e8 in PrefilterPktPayload (det_ctx=0x7fc50f882740, p=0x7fc51a4ff660, pectx=0x7fc6997cd8f0) at detect-engine-payload.c:122 #6 0x00000000005a5b4c in Prefilter (det_ctx=0x7fc50f882740, sgh=0x7fc6991f2b30, p=0x7fc51a4ff660, flags=8 '\b') at detect-engine-prefilter.c:182 #7 0x00000000006f2620 in DetectRunPrefilterPkt (tv=0x7fc6b20c90c0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc50f882740, p=0x7fc51a4ff660, scratch=0x7fc536ce76f0) at detect.c:686 #8 0x00000000006f1d01 in DetectRun (th_v=0x7fc6b20c90c0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc50f882740, p=0x7fc51a4ff660) at detect.c:132 #9 0x00000000006f19ff in DetectFlow (tv=0x7fc6b20c90c0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc50f882740, p=0x7fc51a4ff660) at detect.c:1681 #10 0x00000000006f18a8 in Detect (tv=0x7fc6b20c90c0, p=0x7fc51a4ff660, data=0x7fc50f882740) at detect.c:1753 #11 0x0000000000611758 in FlowWorker (tv=0x7fc6b20c90c0, p=0x7fc51a4ff660, data=0x7fc51a53b0f0) at flow-worker.c:552 #12 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6b20c90c0, p=0x7fc51a4ff660, slot=0x7fc69bac1cb0) at tm-threads.c:117 #13 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6b20c90c0, s=0x7fc69bac1cb0, p=0x7fc51a4ff660) at ./tm-threads.h:195 #14 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc523fff680, pbd=0x7fbfb2a00000, ppd=0x7fbfb2a0aa38) at source-af-packet.c:983 #15 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc523fff680, pbd=0x7fbfb2a00000) at source-af-packet.c:996 #16 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc523fff680) at source-af-packet.c:1043 #17 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6b20c90c0, data=0x7fc523fff680, slot=0x7fc6b9d5b770) at source-af-packet.c:1393 #18 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6b20c90c0) at tm-threads.c:312 #19 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #20 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 60 (Thread 0x7fc23dffb700 (LWP 58687)): #0 futex_abstimed_wait_cancelable (private=, abstime=0x7fc23dffab08, clockid=, expected=0, futex_word=0x7fc6991d83f8) at ../sysdeps/nptl/futex-internal.h:320 #1 __pthread_cond_wait_common (abstime=0x7fc23dffab08, clockid=, mutex=0x7fc690df8550, cond=0x7fc6991d83d0) at pthread_cond_wait.c:520 #2 __pthread_cond_timedwait (cond=0x7fc6991d83d0, mutex=0x7fc690df8550, abstime=0x7fc23dffab08) at pthread_cond_wait.c:656 #3 0x00000000005615a6 in StatsMgmtThread (arg=0x7fc69f760d90) at counters.c:415 #4 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #5 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 59 (Thread 0x7fc23effd700 (LWP 58685)): #0 0x00007fc82fdaa3bf in __GI___clock_nanosleep (clock_id=clock_id@entry=0, flags=flags@entry=0, req=req@entry=0x7fc23effca00, rem=rem@entry=0x0) at ../sysdeps/unix/sysv/linux/clock_nanosleep.c:78 #1 0x00007fc82fdb0047 in __GI___nanosleep (requested_time=requested_time@entry=0x7fc23effca00, remaining=remaining@entry=0x0) at nanosleep.c:27 #2 0x00007fc82fde29bf in usleep (useconds=) at ../sysdeps/posix/usleep.c:32 #3 0x000000000060c410 in FlowRecycler (th_v=0x7fc6ba4b88c0, thread_data=0x7fc22c000b60) at flow-manager.c:1167 #4 0x00000000005071e6 in TmThreadsManagement (td=0x7fc6ba4b88c0) at tm-threads.c:552 #5 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #6 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 58 (Thread 0x7fc32b273700 (LWP 58670)): #0 0x000000000058d5c2 in DetectEnginePktInspectionRun (tv=0x7fc6ba7f92c0, det_ctx=0x7fc303882740, s=0x7fc6bcefeb20, f=0x7fc6bd023150, p=0x7fc30e4ff660, alert_flags=0x7fc32b272677 "") at detect-engine.c:1814 #1 0x00000000006f28b6 in DetectRulePacketRules (tv=0x7fc6ba7f92c0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc303882740, p=0x7fc30e4ff660, pflow=0x7fc6bd023150, scratch=0x7fc32b2726f0) at detect.c:796 #2 0x00000000006f1d1e in DetectRun (th_v=0x7fc6ba7f92c0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc303882740, p=0x7fc30e4ff660) at detect.c:136 #3 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba7f92c0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc303882740, p=0x7fc30e4ff660) at detect.c:1681 #4 0x00000000006f18a8 in Detect (tv=0x7fc6ba7f92c0, p=0x7fc30e4ff660, data=0x7fc303882740) at detect.c:1753 #5 0x0000000000611758 in FlowWorker (tv=0x7fc6ba7f92c0, p=0x7fc30e4ff660, data=0x7fc30e53b0f0) at flow-worker.c:552 #6 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba7f92c0, p=0x7fc30e4ff660, slot=0x7fc6b9fe7e30) at tm-threads.c:117 #7 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba7f92c0, s=0x7fc6b9fe7e30, p=0x7fc30e4ff660) at ./tm-threads.h:195 #8 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc317fff680, pbd=0x7fbc39200000, ppd=0x7fbc3935eac8) at source-af-packet.c:983 #9 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc317fff680, pbd=0x7fbc39200000) at source-af-packet.c:996 #10 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc317fff680) at source-af-packet.c:1043 #11 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba7f92c0, data=0x7fc317fff680, slot=0x7fc6ae0bb820) at source-af-packet.c:1393 #12 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba7f92c0) at tm-threads.c:312 #13 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 57 (Thread 0x7fc4589cf700 (LWP 58655)): #0 DetectPrefilterBuildNonPrefilterList (det_ctx=0x7fc403882740, mask=131 '\203', alproto=0 '\000') at detect.c:380 #1 0x00000000006f2603 in DetectRunPrefilterPkt (tv=0x7fc6ba8d4490, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc403882740, p=0x7fc40e4ff660, scratch=0x7fc4589ce6f0) at detect.c:681 #2 0x00000000006f1d01 in DetectRun (th_v=0x7fc6ba8d4490, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc403882740, p=0x7fc40e4ff660) at detect.c:132 #3 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba8d4490, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc403882740, p=0x7fc40e4ff660) at detect.c:1681 #4 0x00000000006f18a8 in Detect (tv=0x7fc6ba8d4490, p=0x7fc40e4ff660, data=0x7fc403882740) at detect.c:1753 #5 0x0000000000611758 in FlowWorker (tv=0x7fc6ba8d4490, p=0x7fc40e4ff660, data=0x7fc40e53b0f0) at flow-worker.c:552 #6 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba8d4490, p=0x7fc40e4ff660, slot=0x7fc6b9e78890) at tm-threads.c:117 #7 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba8d4490, s=0x7fc6b9e78890, p=0x7fc40e4ff660) at ./tm-threads.h:195 #8 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc417fff680, pbd=0x7fbdef000000, ppd=0x7fbdef192808) at source-af-packet.c:983 #9 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc417fff680, pbd=0x7fbdef000000) at source-af-packet.c:996 #10 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc417fff680) at source-af-packet.c:1043 #11 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba8d4490, data=0x7fc417fff680, slot=0x7fc6b7d15ad0) at source-af-packet.c:1393 #12 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba8d4490) at tm-threads.c:312 #13 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 56 (Thread 0x7fc4051d0700 (LWP 58659)): #0 0x00000000006f4463 in SigDsizePrefilter (p=0x7fc3ca4ff660, s=0x7fc6bcf004e0, sflags=1572879) at ./detect-dsize.h:50 #1 0x00000000006f27b6 in DetectRulePacketRules (tv=0x7fc6ba954a80, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc3bf882740, p=0x7fc3ca4ff660, pflow=0x7fb9ac06a7a0, scratch=0x7fc4051cf6f0) at detect.c:774 #2 0x00000000006f1d1e in DetectRun (th_v=0x7fc6ba954a80, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc3bf882740, p=0x7fc3ca4ff660) at detect.c:136 #3 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba954a80, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc3bf882740, p=0x7fc3ca4ff660) at detect.c:1681 #4 0x00000000006f18a8 in Detect (tv=0x7fc6ba954a80, p=0x7fc3ca4ff660, data=0x7fc3bf882740) at detect.c:1753 #5 0x0000000000611758 in FlowWorker (tv=0x7fc6ba954a80, p=0x7fc3ca4ff660, data=0x7fc3ca53b0f0) at flow-worker.c:552 #6 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba954a80, p=0x7fc3ca4ff660, slot=0x7fc6aa8685c0) at tm-threads.c:117 #7 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba954a80, s=0x7fc6aa8685c0, p=0x7fc3ca4ff660) at ./tm-threads.h:195 #8 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc3d3fff680, pbd=0x7fbd6bc00000, ppd=0x7fbd6bc52028) at source-af-packet.c:983 #9 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc3d3fff680, pbd=0x7fbd6bc00000) at source-af-packet.c:996 #10 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc3d3fff680) at source-af-packet.c:1043 #11 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba954a80, data=0x7fc3d3fff680, slot=0x7fc6b9e81cf0) at source-af-packet.c:1393 #12 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba954a80) at tm-threads.c:312 #13 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 55 (Thread 0x7fc2d6ce8700 (LWP 58675)): #0 0x00007fc83071df3c in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007fc8307555a5 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x00007fc83065947b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #3 0x0000000000523e86 in SCHSSearch (mpm_ctx=0x7fc69973ae80, mpm_thread_ctx=0x7fc2af882828, pmq=0x7fc2af882858, buf=0x7fbba00a1458 , buflen=325) at util-mpm-hs.c:946 #4 0x00000000005a23e8 in PrefilterPktPayload (det_ctx=0x7fc2af882740, p=0x7fc2ba4ff660, pectx=0x7fc69973ae80) at detect-engine-payload.c:122 #5 0x00000000005a5b4c in Prefilter (det_ctx=0x7fc2af882740, sgh=0x7fc698f20bf0, p=0x7fc2ba4ff660, flags=8 '\b') at detect-engine-prefilter.c:182 #6 0x00000000006f2620 in DetectRunPrefilterPkt (tv=0x7fc69f9437a0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc2af882740, p=0x7fc2ba4ff660, scratch=0x7fc2d6ce76f0) at detect.c:686 #7 0x00000000006f1d01 in DetectRun (th_v=0x7fc69f9437a0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc2af882740, p=0x7fc2ba4ff660) at detect.c:132 #8 0x00000000006f19ff in DetectFlow (tv=0x7fc69f9437a0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc2af882740, p=0x7fc2ba4ff660) at detect.c:1681 #9 0x00000000006f18a8 in Detect (tv=0x7fc69f9437a0, p=0x7fc2ba4ff660, data=0x7fc2af882740) at detect.c:1753 #10 0x0000000000611758 in FlowWorker (tv=0x7fc69f9437a0, p=0x7fc2ba4ff660, data=0x7fc2ba53b0f0) at flow-worker.c:552 #11 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc69f9437a0, p=0x7fc2ba4ff660, slot=0x7fc6ba21fa90) at tm-threads.c:117 #12 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc69f9437a0, s=0x7fc6ba21fa90, p=0x7fc2ba4ff660) at ./tm-threads.h:195 #13 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc2c3fff680, pbd=0x7fbba0000000, ppd=0x7fbba00a13d8) at source-af-packet.c:983 #14 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc2c3fff680, pbd=0x7fbba0000000) at source-af-packet.c:996 #15 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc2c3fff680) at source-af-packet.c:1043 #16 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc69f9437a0, data=0x7fc2c3fff680, slot=0x7fc6ba21fd10) at source-af-packet.c:1393 #17 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc69f9437a0) at tm-threads.c:312 #18 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #19 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 54 (Thread 0x7fc36ece8700 (LWP 58666)): #0 0x0000000000523e8d in SCHSSearch (mpm_ctx=0x7fc6997bba70, mpm_thread_ctx=0x7fc347882828, pmq=0x7fc347882858, buf=0x7fbca626a398 , buflen=1366) at util-mpm-hs.c:948 #1 0x00000000005a22e6 in PrefilterPktStream (det_ctx=0x7fc347882740, p=0x7fc3524ff660, pectx=0x7fc6997bba70) at detect-engine-payload.c:99 #2 0x00000000005a5b4c in Prefilter (det_ctx=0x7fc347882740, sgh=0x7fc6997c8280, p=0x7fc3524ff660, flags=4 '\004') at detect-engine-prefilter.c:182 #3 0x00000000006f2620 in DetectRunPrefilterPkt (tv=0x7fc6ba771bf0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc347882740, p=0x7fc3524ff660, scratch=0x7fc36ece76f0) at detect.c:686 #4 0x00000000006f1d01 in DetectRun (th_v=0x7fc6ba771bf0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc347882740, p=0x7fc3524ff660) at detect.c:132 #5 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba771bf0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc347882740, p=0x7fc3524ff660) at detect.c:1681 #6 0x00000000006f18a8 in Detect (tv=0x7fc6ba771bf0, p=0x7fc3524ff660, data=0x7fc347882740) at detect.c:1753 #7 0x0000000000611758 in FlowWorker (tv=0x7fc6ba771bf0, p=0x7fc3524ff660, data=0x7fc35253b0f0) at flow-worker.c:552 #8 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba771bf0, p=0x7fc3524ff660, slot=0x7fc6aa817600) at tm-threads.c:117 #9 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba771bf0, s=0x7fc6aa817600, p=0x7fc3524ff660) at ./tm-threads.h:195 #10 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc35bfff680, pbd=0x7fbca6200000, ppd=0x7fbca626a308) at source-af-packet.c:983 #11 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc35bfff680, pbd=0x7fbca6200000) at source-af-packet.c:996 #12 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc35bfff680) at source-af-packet.c:1043 #13 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba771bf0, data=0x7fc35bfff680, slot=0x7fc6aa7fd940) at source-af-packet.c:1393 #14 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba771bf0) at tm-threads.c:312 #15 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #16 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 53 (Thread 0x7fc5cece8700 (LWP 58630)): #0 DetectPrefilterMergeSort (de_ctx=0x7fc6bce66f30, det_ctx=0x7fc5a7882740) at detect.c:356 #1 0x00000000006f264f in DetectRunPrefilterPkt (tv=0x7fc6bba1b630, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc5a7882740, p=0x7fc5b24ff660, scratch=0x7fc5cece76f0) at detect.c:695 #2 0x00000000006f1d01 in DetectRun (th_v=0x7fc6bba1b630, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc5a7882740, p=0x7fc5b24ff660) at detect.c:132 #3 0x00000000006f19ff in DetectFlow (tv=0x7fc6bba1b630, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc5a7882740, p=0x7fc5b24ff660) at detect.c:1681 #4 0x00000000006f18a8 in Detect (tv=0x7fc6bba1b630, p=0x7fc5b24ff660, data=0x7fc5a7882740) at detect.c:1753 #5 0x0000000000611758 in FlowWorker (tv=0x7fc6bba1b630, p=0x7fc5b24ff660, data=0x7fc5b253b0f0) at flow-worker.c:552 #6 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6bba1b630, p=0x7fc5b24ff660, slot=0x7fc6aeb97a60) at tm-threads.c:117 #7 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6bba1b630, s=0x7fc6aeb97a60, p=0x7fc5b24ff660) at ./tm-threads.h:195 #8 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc5bbfff680, pbd=0x7fc0b0200000, ppd=0x7fc0b029ee30) at source-af-packet.c:983 #9 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc5bbfff680, pbd=0x7fc0b0200000) at source-af-packet.c:996 #10 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc5bbfff680) at source-af-packet.c:1043 #11 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6bba1b630, data=0x7fc5bbfff680, slot=0x7fc6b5b281c0) at source-af-packet.c:1393 #12 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6bba1b630) at tm-threads.c:312 #13 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 52 (Thread 0x7fc4f24e7700 (LWP 58644)): #0 0x00000000006f3f16 in DetectPrefilterBuildNonPrefilterList (det_ctx=0x7fc4bb882740, mask=131 '\203', alproto=1 '\001') at detect.c:378 #1 0x00000000006f2603 in DetectRunPrefilterPkt (tv=0x7fc6b67cf030, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc4bb882740, p=0x7fc4c64ff660, scratch=0x7fc4f24e66f0) at detect.c:681 #2 0x00000000006f1d01 in DetectRun (th_v=0x7fc6b67cf030, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc4bb882740, p=0x7fc4c64ff660) at detect.c:132 #3 0x00000000006f19ff in DetectFlow (tv=0x7fc6b67cf030, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc4bb882740, p=0x7fc4c64ff660) at detect.c:1681 #4 0x00000000006f18a8 in Detect (tv=0x7fc6b67cf030, p=0x7fc4c64ff660, data=0x7fc4bb882740) at detect.c:1753 #5 0x0000000000611758 in FlowWorker (tv=0x7fc6b67cf030, p=0x7fc4c64ff660, data=0x7fc4c653b0f0) at flow-worker.c:552 #6 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6b67cf030, p=0x7fc4c64ff660, slot=0x7fc6b9cedd30) at tm-threads.c:117 #7 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6b67cf030, s=0x7fc6b9cedd30, p=0x7fc4c64ff660) at ./tm-threads.h:195 #8 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc4cffff680, pbd=0x7fbf32200000, ppd=0x7fbf3222b068) at source-af-packet.c:983 #9 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc4cffff680, pbd=0x7fbf32200000) at source-af-packet.c:996 #10 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc4cffff680) at source-af-packet.c:1043 #11 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6b67cf030, data=0x7fc4cffff680, slot=0x7fc6b7a1b030) at source-af-packet.c:1393 #12 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6b67cf030) at tm-threads.c:312 #13 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 51 (Thread 0x7fc4f175b700 (LWP 58645)): #0 0x00007fc83071df76 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007fc8307555a5 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x00007fc83065947b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #3 0x0000000000523e86 in SCHSSearch (mpm_ctx=0x7fc6997cd8f0, mpm_thread_ctx=0x7fc4ab882828, pmq=0x7fc4ab882858, buf=0x7fbf0ad7051c , buflen=474) at util-mpm-hs.c:946 #4 0x00000000005a23e8 in PrefilterPktPayload (det_ctx=0x7fc4ab882740, p=0x7fc4b64ff660, pectx=0x7fc6997cd8f0) at detect-engine-payload.c:122 #5 0x00000000005a5b4c in Prefilter (det_ctx=0x7fc4ab882740, sgh=0x7fc698f1f2c0, p=0x7fc4b64ff660, flags=8 '\b') at detect-engine-prefilter.c:182 #6 0x00000000006f2620 in DetectRunPrefilterPkt (tv=0x7fc6b0a035f0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc4ab882740, p=0x7fc4b64ff660, scratch=0x7fc4f175a6f0) at detect.c:686 #7 0x00000000006f1d01 in DetectRun (th_v=0x7fc6b0a035f0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc4ab882740, p=0x7fc4b64ff660) at detect.c:132 #8 0x00000000006f19ff in DetectFlow (tv=0x7fc6b0a035f0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc4ab882740, p=0x7fc4b64ff660) at detect.c:1681 #9 0x00000000006f18a8 in Detect (tv=0x7fc6b0a035f0, p=0x7fc4b64ff660, data=0x7fc4ab882740) at detect.c:1753 #10 0x0000000000611758 in FlowWorker (tv=0x7fc6b0a035f0, p=0x7fc4b64ff660, data=0x7fc4b653b0f0) at flow-worker.c:552 #11 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6b0a035f0, p=0x7fc4b64ff660, slot=0x7fc6ae03c3c0) at tm-threads.c:117 #12 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6b0a035f0, s=0x7fc6ae03c3c0, p=0x7fc4b64ff660) at ./tm-threads.h:195 #13 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc4bffff680, pbd=0x7fbf0ac00000, ppd=0x7fbf0ad70490) at source-af-packet.c:983 #14 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc4bffff680, pbd=0x7fbf0ac00000) at source-af-packet.c:996 #15 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc4bffff680) at source-af-packet.c:1043 #16 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6b0a035f0, data=0x7fc4bffff680, slot=0x7fc6aa642900) at source-af-packet.c:1393 #17 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6b0a035f0) at tm-threads.c:312 #18 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #19 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 50 (Thread 0x7fc45975b700 (LWP 58654)): #0 0x00000000006f2735 in DetectRulePacketRules (tv=0x7fc6ba8b0650, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc413882740, p=0x7fc41e4ff660, pflow=0x7fac92d94620, scratch=0x7fc45975a6f0) at detect.c:754 #1 0x00000000006f1d1e in DetectRun (th_v=0x7fc6ba8b0650, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc413882740, p=0x7fc41e4ff660) at detect.c:136 #2 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba8b0650, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc413882740, p=0x7fc41e4ff660) at detect.c:1681 #3 0x00000000006f18a8 in Detect (tv=0x7fc6ba8b0650, p=0x7fc41e4ff660, data=0x7fc413882740) at detect.c:1753 #4 0x0000000000611758 in FlowWorker (tv=0x7fc6ba8b0650, p=0x7fc41e4ff660, data=0x7fc41e53b0f0) at flow-worker.c:552 #5 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba8b0650, p=0x7fc41e4ff660, slot=0x7fc6b2ae6e60) at tm-threads.c:117 #6 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba8b0650, s=0x7fc6b2ae6e60, p=0x7fc41e4ff660) at ./tm-threads.h:195 #7 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc427fff680, pbd=0x7fbe12e00000, ppd=0x7fbe12e31218) at source-af-packet.c:983 #8 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc427fff680, pbd=0x7fbe12e00000) at source-af-packet.c:996 #9 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc427fff680) at source-af-packet.c:1043 #10 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba8b0650, data=0x7fc427fff680, slot=0x7fc6b2bd4cf0) at source-af-packet.c:1393 #11 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba8b0650) at tm-threads.c:312 #12 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #13 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 49 (Thread 0x7fc3c175b700 (LWP 58663)): #0 0x00000000006f3f14 in DetectPrefilterBuildNonPrefilterList (det_ctx=0x7fc37b882740, mask=131 '\203', alproto=0 '\000') at detect.c:378 #1 0x00000000006f2603 in DetectRunPrefilterPkt (tv=0x7fc6ba7321c0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc37b882740, p=0x7fc3864ff660, scratch=0x7fc3c175a6f0) at detect.c:681 #2 0x00000000006f1d01 in DetectRun (th_v=0x7fc6ba7321c0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc37b882740, p=0x7fc3864ff660) at detect.c:132 #3 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba7321c0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc37b882740, p=0x7fc3864ff660) at detect.c:1681 #4 0x00000000006f18a8 in Detect (tv=0x7fc6ba7321c0, p=0x7fc3864ff660, data=0x7fc37b882740) at detect.c:1753 #5 0x0000000000611758 in FlowWorker (tv=0x7fc6ba7321c0, p=0x7fc3864ff660, data=0x7fc38653b0f0) at flow-worker.c:552 #6 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba7321c0, p=0x7fc3864ff660, slot=0x7fc6ba0bc5b0) at tm-threads.c:117 #7 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba7321c0, s=0x7fc6ba0bc5b0, p=0x7fc3864ff660) at ./tm-threads.h:195 #8 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc38ffff680, pbd=0x7fbd01800000, ppd=0x7fbd0195fbe0) at source-af-packet.c:983 #9 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc38ffff680, pbd=0x7fbd01800000) at source-af-packet.c:996 #10 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc38ffff680) at source-af-packet.c:1043 #11 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba7321c0, data=0x7fc38ffff680, slot=0x7fc6a38186c0) at source-af-packet.c:1393 #12 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba7321c0) at tm-threads.c:312 #13 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 48 (Thread 0x7fc3c3273700 (LWP 58661)): #0 0x00007fc830737964 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007fc830758a56 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x00007fc83075d5ad in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #3 0x00007fc8307572c7 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #4 0x00007fc83065947b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #5 0x0000000000523e86 in SCHSSearch (mpm_ctx=0x7fc6997c55d0, mpm_thread_ctx=0x7fc39b882828, pmq=0x7fc39b882858, buf=0x7fbd3baa34b0 , buflen=1366) at util-mpm-hs.c:946 #6 0x00000000005a23e8 in PrefilterPktPayload (det_ctx=0x7fc39b882740, p=0x7fc3a64ff660, pectx=0x7fc6997c55d0) at detect-engine-payload.c:122 #7 0x00000000005a5b4c in Prefilter (det_ctx=0x7fc39b882740, sgh=0x7fc6997c8280, p=0x7fc3a64ff660, flags=4 '\004') at detect-engine-prefilter.c:182 #8 0x00000000006f2620 in DetectRunPrefilterPkt (tv=0x7fc6ba715090, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc39b882740, p=0x7fc3a64ff660, scratch=0x7fc3c32726f0) at detect.c:686 #9 0x00000000006f1d01 in DetectRun (th_v=0x7fc6ba715090, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc39b882740, p=0x7fc3a64ff660) at detect.c:132 #10 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba715090, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc39b882740, p=0x7fc3a64ff660) at detect.c:1681 #11 0x00000000006f18a8 in Detect (tv=0x7fc6ba715090, p=0x7fc3a64ff660, data=0x7fc39b882740) at detect.c:1753 #12 0x0000000000611758 in FlowWorker (tv=0x7fc6ba715090, p=0x7fc3a64ff660, data=0x7fc3a653b0f0) at flow-worker.c:552 #13 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba715090, p=0x7fc3a64ff660, slot=0x7fc6b2c979f0) at tm-threads.c:117 #14 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba715090, s=0x7fc6b2c979f0, p=0x7fc3a64ff660) at ./tm-threads.h:195 #15 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc3affff680, pbd=0x7fbd3ba00000, ppd=0x7fbd3baa3420) at source-af-packet.c:983 #16 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc3affff680, pbd=0x7fbd3ba00000) at source-af-packet.c:996 #17 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc3affff680) at source-af-packet.c:1043 #18 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba715090, data=0x7fc3affff680, slot=0x7fc6a6815f60) at source-af-packet.c:1393 #19 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba715090) at tm-threads.c:312 #20 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #21 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 47 (Thread 0x7fc407a74700 (LWP 58656)): #0 0x00000000005a239d in PrefilterPktPayload (det_ctx=0x7fc3ef882740, p=0x7fc3fa4ff660, pectx=0x7fc699966b30) at detect-engine-payload.c:122 #1 0x00000000005a5b4c in Prefilter (det_ctx=0x7fc3ef882740, sgh=0x7fc698f20140, p=0x7fc3fa4ff660, flags=4 '\004') at detect-engine-prefilter.c:182 #2 0x00000000006f2620 in DetectRunPrefilterPkt (tv=0x7fc6ba901ec0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc3ef882740, p=0x7fc3fa4ff660, scratch=0x7fc407a736f0) at detect.c:686 #3 0x00000000006f1d01 in DetectRun (th_v=0x7fc6ba901ec0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc3ef882740, p=0x7fc3fa4ff660) at detect.c:132 #4 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba901ec0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc3ef882740, p=0x7fc3fa4ff660) at detect.c:1681 #5 0x00000000006f18a8 in Detect (tv=0x7fc6ba901ec0, p=0x7fc3fa4ff660, data=0x7fc3ef882740) at detect.c:1753 #6 0x0000000000611758 in FlowWorker (tv=0x7fc6ba901ec0, p=0x7fc3fa4ff660, data=0x7fc3fa53b0f0) at flow-worker.c:552 #7 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba901ec0, p=0x7fc3fa4ff660, slot=0x7fc6aa6e89e0) at tm-threads.c:117 #8 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba901ec0, s=0x7fc6aa6e89e0, p=0x7fc3fa4ff660) at ./tm-threads.h:195 #9 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc3fffff680, pbd=0x7fbdd5000000, ppd=0x7fbdd508ac48) at source-af-packet.c:983 #10 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc3fffff680, pbd=0x7fbdd5000000) at source-af-packet.c:996 #11 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc3fffff680) at source-af-packet.c:1043 #12 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba901ec0, data=0x7fc3fffff680, slot=0x7fc6b0027680) at source-af-packet.c:1393 #13 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba901ec0) at tm-threads.c:312 #14 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #15 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 46 (Thread 0x7fc5889cf700 (LWP 58637)): #0 0x00000000006f3f1b in DetectPrefilterBuildNonPrefilterList (det_ctx=0x7fc533882740, mask=131 '\203', alproto=4 '\004') at detect.c:378 #1 0x00000000006f2603 in DetectRunPrefilterPkt (tv=0x7fc6ab6a3650, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc533882740, p=0x7fc53e4fcd20, scratch=0x7fc5889ce580) at detect.c:681 #2 0x00000000006f1d01 in DetectRun (th_v=0x7fc6ab6a3650, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc533882740, p=0x7fc53e4fcd20) at detect.c:132 #3 0x00000000006f19ff in DetectFlow (tv=0x7fc6ab6a3650, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc533882740, p=0x7fc53e4fcd20) at detect.c:1681 #4 0x00000000006f18a8 in Detect (tv=0x7fc6ab6a3650, p=0x7fc53e4fcd20, data=0x7fc533882740) at detect.c:1753 #5 0x000000000061246d in FlowWorkerFlowTimeout (tv=0x7fc6ab6a3650, p=0x7fc53e4fcd20, fw=0x7fc53e53b0f0, detect_thread=0x7fc533882740) at flow-worker.c:421 #6 0x00000000006123d8 in FlowFinish (tv=0x7fc6ab6a3650, f=0x7facfa8c1280, fw=0x7fc53e53b0f0, detect_thread=0x7fc533882740) at flow-worker.c:157 #7 0x000000000061208c in CheckWorkQueue (tv=0x7fc6ab6a3650, fw=0x7fc53e53b0f0, detect_thread=0x7fc533882740, counters=0x7fc5889ce768, fq=0x7fc5889ce790) at flow-worker.c:177 #8 0x0000000000611ed9 in FlowWorkerProcessInjectedFlows (tv=0x7fc6ab6a3650, fw=0x7fc53e53b0f0, p=0x7fc53e4ff660, detect_thread=0x7fc533882740) at flow-worker.c:460 #9 0x000000000061189b in FlowWorker (tv=0x7fc6ab6a3650, p=0x7fc53e4ff660, data=0x7fc53e53b0f0) at flow-worker.c:590 #10 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ab6a3650, p=0x7fc53e4ff660, slot=0x7fc6aca30f80) at tm-threads.c:117 #11 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ab6a3650, s=0x7fc6aca30f80, p=0x7fc53e4ff660) at ./tm-threads.h:195 #12 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc547fff680, pbd=0x7fbffd000000, ppd=0x7fbffd0e63e8) at source-af-packet.c:983 #13 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc547fff680, pbd=0x7fbffd000000) at source-af-packet.c:996 #14 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc547fff680) at source-af-packet.c:1043 #15 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ab6a3650, data=0x7fc547fff680, slot=0x7fc6b612a8d0) at source-af-packet.c:1393 #16 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ab6a3650) at tm-threads.c:312 #17 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #18 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 45 (Thread 0x7fc3c3fff700 (LWP 58660)): #0 0x00000000006f28b8 in DetectRulePacketRules (tv=0x7fc6ba960300, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc3ab882740, p=0x7fc3b64ff660, pflow=0x7fc6bcff0fe0, scratch=0x7fc3c3ffe6f0) at detect.c:796 #1 0x00000000006f1d1e in DetectRun (th_v=0x7fc6ba960300, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc3ab882740, p=0x7fc3b64ff660) at detect.c:136 #2 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba960300, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc3ab882740, p=0x7fc3b64ff660) at detect.c:1681 #3 0x00000000006f18a8 in Detect (tv=0x7fc6ba960300, p=0x7fc3b64ff660, data=0x7fc3ab882740) at detect.c:1753 #4 0x0000000000611758 in FlowWorker (tv=0x7fc6ba960300, p=0x7fc3b64ff660, data=0x7fc3b653b0f0) at flow-worker.c:552 #5 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba960300, p=0x7fc3b64ff660, slot=0x7fc6b7eb37b0) at tm-threads.c:117 #6 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba960300, s=0x7fc6b7eb37b0, p=0x7fc3b64ff660) at ./tm-threads.h:195 #7 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc3bbfff680, pbd=0x7fbd59000000, ppd=0x7fbd590afa48) at source-af-packet.c:983 #8 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc3bbfff680, pbd=0x7fbd59000000) at source-af-packet.c:996 #9 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc3bbfff680) at source-af-packet.c:1043 #10 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba960300, data=0x7fc3bbfff680, slot=0x7fc6b9e5d270) at source-af-packet.c:1393 #11 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba960300) at tm-threads.c:312 #12 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #13 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 44 (Thread 0x7fc406ce8700 (LWP 58657)): #0 0x00000000006f4790 in DetectRunInspectRuleHeader (p=0x7fc3ea4ff660, f=0x7fc6be4ffbf0, s=0x7fc6bcd2f0e0, sflags=1572879, s_proto_flags=1 '\001') at detect.c:623 #1 0x00000000006f288b in DetectRulePacketRules (tv=0x7fc6ba916050, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc3df882740, p=0x7fc3ea4ff660, pflow=0x7fc6be4ffbf0, scratch=0x7fc406ce76f0) at detect.c:792 #2 0x00000000006f1d1e in DetectRun (th_v=0x7fc6ba916050, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc3df882740, p=0x7fc3ea4ff660) at detect.c:136 #3 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba916050, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc3df882740, p=0x7fc3ea4ff660) at detect.c:1681 #4 0x00000000006f18a8 in Detect (tv=0x7fc6ba916050, p=0x7fc3ea4ff660, data=0x7fc3df882740) at detect.c:1753 #5 0x0000000000611758 in FlowWorker (tv=0x7fc6ba916050, p=0x7fc3ea4ff660, data=0x7fc3ea53b0f0) at flow-worker.c:552 #6 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba916050, p=0x7fc3ea4ff660, slot=0x7fc6b37ba560) at tm-threads.c:117 #7 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba916050, s=0x7fc6b37ba560, p=0x7fc3ea4ff660) at ./tm-threads.h:195 #8 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc3f3fff680, pbd=0x7fbdbb800000, ppd=0x7fbdbb9537e8) at source-af-packet.c:983 #9 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc3f3fff680, pbd=0x7fbdbb800000) at source-af-packet.c:996 #10 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc3f3fff680) at source-af-packet.c:1043 #11 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba916050, data=0x7fc3f3fff680, slot=0x7fc69e231080) at source-af-packet.c:1393 #12 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba916050) at tm-threads.c:312 #13 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 43 (Thread 0x7fc45a4e7700 (LWP 58653)): #0 0x0000000000677f4f in TCPSEG_RB_MINMAX (head=0x7fb80279d208, val=-1) at stream-tcp-list.c:49 #1 0x0000000000678fbd in GetLeftEdge (f=0x7fb3bd08f240, ssn=0x7fb80279d100, stream=0x7fb80279d198) at stream-tcp-list.c:799 #2 0x00000000006789a8 in StreamTcpPruneSession (f=0x7fb3bd08f240, flags=4 '\004') at stream-tcp-list.c:871 #3 0x00000000006124cd in FlowWorkerFlowTimeout (tv=0x7fc6ba88bb10, p=0x7fc42e4fe1c0, fw=0x7fc42e53b0f0, detect_thread=0x7fc423882740) at flow-worker.c:434 #4 0x00000000006123af in FlowFinish (tv=0x7fc6ba88bb10, f=0x7fb3bd08f240, fw=0x7fc42e53b0f0, detect_thread=0x7fc423882740) at flow-worker.c:154 #5 0x000000000061208c in CheckWorkQueue (tv=0x7fc6ba88bb10, fw=0x7fc42e53b0f0, detect_thread=0x7fc423882740, counters=0x7fc45a4e6768, fq=0x7fc45a4e6790) at flow-worker.c:177 #6 0x0000000000611ed9 in FlowWorkerProcessInjectedFlows (tv=0x7fc6ba88bb10, fw=0x7fc42e53b0f0, p=0x7fc42e4ff660, detect_thread=0x7fc423882740) at flow-worker.c:460 #7 0x000000000061189b in FlowWorker (tv=0x7fc6ba88bb10, p=0x7fc42e4ff660, data=0x7fc42e53b0f0) at flow-worker.c:590 #8 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba88bb10, p=0x7fc42e4ff660, slot=0x7fc6ac9c09d0) at tm-threads.c:117 #9 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba88bb10, s=0x7fc6ac9c09d0, p=0x7fc42e4ff660) at ./tm-threads.h:195 #10 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc437fff680, pbd=0x7fbe2da00000, ppd=0x7fbe2da98980) at source-af-packet.c:983 #11 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc437fff680, pbd=0x7fbe2da00000) at source-af-packet.c:996 #12 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc437fff680) at source-af-packet.c:1043 #13 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba88bb10, data=0x7fc437fff680, slot=0x7fc6aa593160) at source-af-packet.c:1393 #14 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba88bb10) at tm-threads.c:312 #15 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #16 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 42 (Thread 0x7fc623fff700 (LWP 58624)): #0 0x00000000006f4af8 in DetectReplaceFree (det_ctx=0x7fc60b8824e0) at ./detect-replace.h:35 #1 0x00000000006f2914 in DetectRulePacketRules (tv=0x7fc690cdf810, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc60b8824e0, p=0x7fc6164ff660, pflow=0x7fb917ce0ef0, scratch=0x7fc623ffe6f0) at detect.c:808 #2 0x00000000006f1d1e in DetectRun (th_v=0x7fc690cdf810, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc60b8824e0, p=0x7fc6164ff660) at detect.c:136 #3 0x00000000006f19ff in DetectFlow (tv=0x7fc690cdf810, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc60b8824e0, p=0x7fc6164ff660) at detect.c:1681 #4 0x00000000006f18a8 in Detect (tv=0x7fc690cdf810, p=0x7fc6164ff660, data=0x7fc60b8824e0) at detect.c:1753 #5 0x0000000000611758 in FlowWorker (tv=0x7fc690cdf810, p=0x7fc6164ff660, data=0x7fc61653b0f0) at flow-worker.c:552 #6 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc690cdf810, p=0x7fc6164ff660, slot=0x7fc69f9a4a70) at tm-threads.c:117 #7 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc690cdf810, s=0x7fc69f9a4a70, p=0x7fc6164ff660) at ./tm-threads.h:195 #8 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc61bfff680, pbd=0x7fc169600000, ppd=0x7fc1696cf438) at source-af-packet.c:983 #9 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc61bfff680, pbd=0x7fc169600000) at source-af-packet.c:996 #10 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc61bfff680) at source-af-packet.c:1043 #11 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc690cdf810, data=0x7fc61bfff680, slot=0x7fc6b7573840) at source-af-packet.c:1393 #12 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc690cdf810) at tm-threads.c:312 #13 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 41 (Thread 0x7fc2909cf700 (LWP 58682)): #0 0x00007fc82fdaa3bf in __GI___clock_nanosleep (clock_id=clock_id@entry=0, flags=flags@entry=0, req=req@entry=0x7fc2909ce940, rem=rem@entry=0x0) at ../sysdeps/unix/sysv/linux/clock_nanosleep.c:78 #1 0x00007fc82fdb0047 in __GI___nanosleep (requested_time=requested_time@entry=0x7fc2909ce940, remaining=remaining@entry=0x0) at nanosleep.c:27 #2 0x00007fc82fde29bf in usleep (useconds=) at ../sysdeps/posix/usleep.c:32 #3 0x000000000060bff4 in FlowManager (th_v=0x7fc6ba680040, thread_data=0x7fc24c000b60) at flow-manager.c:971 #4 0x00000000005071e6 in TmThreadsManagement (td=0x7fc6ba680040) at tm-threads.c:552 #5 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #6 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 40 (Thread 0x7fc4f3273700 (LWP 58643)): #0 __memset_avx2_erms () at ../sysdeps/x86_64/multiarch/memset-vec-unaligned-erms.S:151 #1 0x00007fc82fd68f72 in __libc_calloc (n=, elem_size=) at malloc.c:3480 #2 0x00000000005209ad in SCCallocFunc (nm=1, sz=16773) at util-mem.c:57 #3 0x000000000054920d in HTPCalloc (n=1, size=16773) at app-layer-htp-mem.c:161 #4 0x000000000052ee6c in InitBuffer (sb=0x7faee8722f00) at util-streaming-buffer.c:104 #5 0x000000000052edbb in StreamingBufferInit (cfg=0xd2d020 ) at util-streaming-buffer.c:120 #6 0x00000000006e100e in HtpBodyAppendChunk (hcfg=0xd2d010 , body=0x7fb16ec2c738, data=0x7fb8cb477859 "PK", len=2) at app-layer-htp-body.c:92 #7 0x0000000000543f5c in HTPCallbackResponseBodyData (d=0x7fc4f3271ff0) at app-layer-htp.c:1977 #8 0x00007fc830bdeb61 in htp_hook_run_all (hook=0x1c40cc0, user_data=0x7fc4f3271ff0) at htp_hooks.c:127 #9 0x00007fc830beb7ec in htp_res_run_hook_body_data (connp=, d=) at htp_util.c:2337 #10 0x00007fc830be6723 in htp_tx_res_process_body_data_ex (tx=0x7fb16f8a3580, data=0x7fb8cb477859, len=140411458337680) at htp_transaction.c:1007 #11 0x00007fc830be3b51 in htp_connp_RES_BODY_IDENTITY_CL_KNOWN (connp=0x7faf8f63f260) at htp_response.c:487 #12 0x00007fc830be4945 in htp_connp_res_data (connp=0x7faf8f63f260, timestamp=, data=, len=) at htp_response.c:1321 #13 0x0000000000543281 in HTPHandleResponseData (f=0x7fc6c9335fc0, htp_state=0x7fb64de54140, pstate=0x7fb16ef679d0, stream_slice=..., local_data=0x0) at app-layer-htp.c:942 #14 0x000000000054f1fe in AppLayerParserParse (tv=0x7fc6a9f82cf0, alp_tctx=0x7fc4d659db30, f=0x7fc6c9335fc0, alproto=1, flags=11 '\v', input=0x7fb8cb477430 "HTTP/1.1 206 Partial Content\r\nCache-Control: public, max-age=17280000\r\nContent-Type: application/octet-stream\r\nAccept-Ranges: bytes\r\nServer: Microsoft-IIS/10.0\r\nX-AspNetMvc-Version: 5.2\r\nMS-Correlatio"..., input_len=1067) at app-layer-parser.c:1304 #15 0x000000000053599c in TCPProtoDetect (tv=0x7fc6a9f82cf0, ra_ctx=0x7fc4d6573c30, app_tctx=0x7fc4d6573c60, p=0x7fc4d64fec10, f=0x7fc6c9335fc0, ssn=0x7fb544809800, stream=0x7fc4f32724f0, data=0x7fb8cb477430 "HTTP/1.1 206 Partial Content\r\nCache-Control: public, max-age=17280000\r\nContent-Type: application/octet-stream\r\nAccept-Ranges: bytes\r\nServer: Microsoft-IIS/10.0\r\nX-AspNetMvc-Version: 5.2\r\nMS-Correlatio"..., data_len=1067, flags=11 '\v') at app-layer.c:461 #16 0x00000000005350e4 in AppLayerHandleTCPData (tv=0x7fc6a9f82cf0, ra_ctx=0x7fc4d6573c30, p=0x7fc4d64fec10, f=0x7fc6c9335fc0, ssn=0x7fb544809800, stream=0x7fc4f32724f0, data=0x7fb8cb477430 "HTTP/1.1 206 Partial Content\r\nCache-Control: public, max-age=17280000\r\nContent-Type: application/octet-stream\r\nAccept-Ranges: bytes\r\nServer: Microsoft-IIS/10.0\r\nX-AspNetMvc-Version: 5.2\r\nMS-Correlatio"..., data_len=1067, flags=11 '\v') at app-layer.c:648 #17 0x000000000067b885 in ReassembleUpdateAppLayer (tv=0x7fc6a9f82cf0, ra_ctx=0x7fc4d6573c30, ssn=0x7fb544809800, stream=0x7fc4f32724f0, p=0x7fc4d64fec10, dir=UPDATE_DIR_PACKET) at stream-tcp-reassemble.c:1200 #18 0x000000000067b240 in StreamTcpReassembleAppLayer (tv=0x7fc6a9f82cf0, ra_ctx=0x7fc4d6573c30, ssn=0x7fb544809800, stream=0x7fb544809810, p=0x7fc4d64fec10, dir=UPDATE_DIR_PACKET) at stream-tcp-reassemble.c:1264 #19 0x000000000067cf60 in StreamTcpReassembleHandleSegment (tv=0x7fc6a9f82cf0, ra_ctx=0x7fc4d6573c30, ssn=0x7fb544809800, stream=0x7fb544809810, p=0x7fc4d64fec10, pq=0x7fc4d653b120) at stream-tcp-reassemble.c:1930 #20 0x00000000006617d2 in StreamTcpPacket (tv=0x7fc6a9f82cf0, p=0x7fc4d64fec10, stt=0x7fc4dffffc70, pq=0x7fc4d653b120) at stream-tcp.c:4936 #21 0x0000000000664136 in StreamTcp (tv=0x7fc6a9f82cf0, p=0x7fc4d64fec10, data=0x7fc4dffffc70, pq=0x7fc4d653b120) at stream-tcp.c:5312 #22 0x0000000000611bb3 in FlowWorkerStreamTCPUpdate (tv=0x7fc6a9f82cf0, fw=0x7fc4d653b0f0, p=0x7fc4d64fec10, detect_thread=0x7fc4cb882740, timeout=true) at flow-worker.c:370 #23 0x0000000000612438 in FlowWorkerFlowTimeout (tv=0x7fc6a9f82cf0, p=0x7fc4d64fec10, fw=0x7fc4d653b0f0, detect_thread=0x7fc4cb882740) at flow-worker.c:413 #24 0x00000000006123d8 in FlowFinish (tv=0x7fc6a9f82cf0, f=0x7fc6c9335fc0, fw=0x7fc4d653b0f0, detect_thread=0x7fc4cb882740) at flow-worker.c:157 #25 0x000000000061208c in CheckWorkQueue (tv=0x7fc6a9f82cf0, fw=0x7fc4d653b0f0, detect_thread=0x7fc4cb882740, counters=0x7fc4f3272768, fq=0x7fc4f3272790) at flow-worker.c:177 #26 0x0000000000611ed9 in FlowWorkerProcessInjectedFlows (tv=0x7fc6a9f82cf0, fw=0x7fc4d653b0f0, p=0x7fc4d64ff660, detect_thread=0x7fc4cb882740) at flow-worker.c:460 #27 0x000000000061189b in FlowWorker (tv=0x7fc6a9f82cf0, p=0x7fc4d64ff660, data=0x7fc4d653b0f0) at flow-worker.c:590 #28 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6a9f82cf0, p=0x7fc4d64ff660, slot=0x7fc6b673df10) at tm-threads.c:117 #29 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6a9f82cf0, s=0x7fc6b673df10, p=0x7fc4d64ff660) at ./tm-threads.h:195 #30 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc4dffff680, pbd=0x7fbf4f000000, ppd=0x7fbf4f024418) at source-af-packet.c:983 #31 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc4dffff680, pbd=0x7fbf4f000000) at source-af-packet.c:996 #32 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc4dffff680) at source-af-packet.c:1043 #33 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6a9f82cf0, data=0x7fc4dffff680, slot=0x7fc6b782b7a0) at source-af-packet.c:1393 #34 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6a9f82cf0) at tm-threads.c:312 #35 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #36 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 39 (Thread 0x7fc45b273700 (LWP 58652)): #0 0x00000000006f27d8 in DetectRulePacketRules (tv=0x7fc6baae3b40, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc433882740, p=0x7fc43e4ff660, pflow=0x7fc6be6f2db0, scratch=0x7fc45b2726f0) at detect.c:778 #1 0x00000000006f1d1e in DetectRun (th_v=0x7fc6baae3b40, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc433882740, p=0x7fc43e4ff660) at detect.c:136 #2 0x00000000006f19ff in DetectFlow (tv=0x7fc6baae3b40, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc433882740, p=0x7fc43e4ff660) at detect.c:1681 #3 0x00000000006f18a8 in Detect (tv=0x7fc6baae3b40, p=0x7fc43e4ff660, data=0x7fc433882740) at detect.c:1753 #4 0x0000000000611758 in FlowWorker (tv=0x7fc6baae3b40, p=0x7fc43e4ff660, data=0x7fc43e53b0f0) at flow-worker.c:552 #5 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6baae3b40, p=0x7fc43e4ff660, slot=0x7fc69ab66b70) at tm-threads.c:117 #6 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6baae3b40, s=0x7fc69ab66b70, p=0x7fc43e4ff660) at ./tm-threads.h:195 #7 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc447fff680, pbd=0x7fbe39a00000, ppd=0x7fbe39a66708) at source-af-packet.c:983 #8 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc447fff680, pbd=0x7fbe39a00000) at source-af-packet.c:996 #9 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc447fff680) at source-af-packet.c:1043 #10 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6baae3b40, data=0x7fc447fff680, slot=0x7fc6b7d327b0) at source-af-packet.c:1393 #11 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6baae3b40) at tm-threads.c:312 #12 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #13 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 38 (Thread 0x7fc49df5c700 (LWP 58649)): #0 0x00007fc83071deee in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007fc8307555a5 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x00007fc83065947b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #3 0x0000000000523e86 in SCHSSearch (mpm_ctx=0x7fc6997c55d0, mpm_thread_ctx=0x7fc467882828, pmq=0x7fc467882858, buf=0x7fbe8dc5da50 , buflen=1371) at util-mpm-hs.c:946 #4 0x00000000005a23e8 in PrefilterPktPayload (det_ctx=0x7fc467882740, p=0x7fc4724ff660, pectx=0x7fc6997c55d0) at detect-engine-payload.c:122 #5 0x00000000005a5b4c in Prefilter (det_ctx=0x7fc467882740, sgh=0x7fc6997c8280, p=0x7fc4724ff660, flags=4 '\004') at detect-engine-prefilter.c:182 #6 0x00000000006f2620 in DetectRunPrefilterPkt (tv=0x7fc6baab46a0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc467882740, p=0x7fc4724ff660, scratch=0x7fc49df5b6f0) at detect.c:686 #7 0x00000000006f1d01 in DetectRun (th_v=0x7fc6baab46a0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc467882740, p=0x7fc4724ff660) at detect.c:132 #8 0x00000000006f19ff in DetectFlow (tv=0x7fc6baab46a0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc467882740, p=0x7fc4724ff660) at detect.c:1681 #9 0x00000000006f18a8 in Detect (tv=0x7fc6baab46a0, p=0x7fc4724ff660, data=0x7fc467882740) at detect.c:1753 #10 0x0000000000611758 in FlowWorker (tv=0x7fc6baab46a0, p=0x7fc4724ff660, data=0x7fc47253b0f0) at flow-worker.c:552 #11 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6baab46a0, p=0x7fc4724ff660, slot=0x7fc6b9f1dbf0) at tm-threads.c:117 #12 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6baab46a0, s=0x7fc6b9f1dbf0, p=0x7fc4724ff660) at ./tm-threads.h:195 #13 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc47bfff680, pbd=0x7fbe8dc00000, ppd=0x7fbe8dc5d9b8) at source-af-packet.c:983 #14 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc47bfff680, pbd=0x7fbe8dc00000) at source-af-packet.c:996 #15 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc47bfff680) at source-af-packet.c:1043 #16 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6baab46a0, data=0x7fc47bfff680, slot=0x7fc6b79ecbf0) at source-af-packet.c:1393 #17 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6baab46a0) at tm-threads.c:312 #18 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #19 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 37 (Thread 0x7fc49d1d0700 (LWP 58650)): #0 0x000000000054e150 in AppLayerParserGetDecoderEvents (pstate=0x7fb00b6b4fe0) at app-layer-parser.c:871 #1 0x000000000054f849 in AppLayerParserHasDecoderEvents (pstate=0x7fb00b6b4fe0) at app-layer-parser.c:1437 #2 0x00000000006f213d in DetectRunSetup (de_ctx=0x7fc6bce66f30, det_ctx=0x7fc457882740, p=0x7fc4624ff660, pflow=0x7fb518b33800) at detect.c:902 #3 0x00000000006f1ca0 in DetectRun (th_v=0x7fc6baabc7e0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc457882740, p=0x7fc4624ff660) at detect.c:117 #4 0x00000000006f19ff in DetectFlow (tv=0x7fc6baabc7e0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc457882740, p=0x7fc4624ff660) at detect.c:1681 #5 0x00000000006f18a8 in Detect (tv=0x7fc6baabc7e0, p=0x7fc4624ff660, data=0x7fc457882740) at detect.c:1753 #6 0x0000000000611758 in FlowWorker (tv=0x7fc6baabc7e0, p=0x7fc4624ff660, data=0x7fc46253b0f0) at flow-worker.c:552 #7 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6baabc7e0, p=0x7fc4624ff660, slot=0x7fc6ae0041b0) at tm-threads.c:117 #8 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6baabc7e0, s=0x7fc6ae0041b0, p=0x7fc4624ff660) at ./tm-threads.h:195 #9 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc46bfff680, pbd=0x7fbe86400000, ppd=0x7fbe8643a648) at source-af-packet.c:983 #10 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc46bfff680, pbd=0x7fbe86400000) at source-af-packet.c:996 #11 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc46bfff680) at source-af-packet.c:1043 #12 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6baabc7e0, data=0x7fc46bfff680, slot=0x7fc6a6a5ef60) at source-af-packet.c:1393 #13 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6baabc7e0) at tm-threads.c:312 #14 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #15 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 36 (Thread 0x7fc58a4e7700 (LWP 58635)): #0 0x00000000006f3f23 in DetectPrefilterBuildNonPrefilterList (det_ctx=0x7fc553882740, mask=131 '\203', alproto=0 '\000') at detect.c:379 #1 0x00000000006f2603 in DetectRunPrefilterPkt (tv=0x7fc6b01feb20, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc553882740, p=0x7fc55e4ff660, scratch=0x7fc58a4e66f0) at detect.c:681 #2 0x00000000006f1d01 in DetectRun (th_v=0x7fc6b01feb20, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc553882740, p=0x7fc55e4ff660) at detect.c:132 #3 0x00000000006f19ff in DetectFlow (tv=0x7fc6b01feb20, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc553882740, p=0x7fc55e4ff660) at detect.c:1681 #4 0x00000000006f18a8 in Detect (tv=0x7fc6b01feb20, p=0x7fc55e4ff660, data=0x7fc553882740) at detect.c:1753 #5 0x0000000000611758 in FlowWorker (tv=0x7fc6b01feb20, p=0x7fc55e4ff660, data=0x7fc55e53b0f0) at flow-worker.c:552 #6 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6b01feb20, p=0x7fc55e4ff660, slot=0x7fc6b79028b0) at tm-threads.c:117 #7 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6b01feb20, s=0x7fc6b79028b0, p=0x7fc55e4ff660) at ./tm-threads.h:195 #8 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc567fff680, pbd=0x7fc028600000, ppd=0x7fc02864cae0) at source-af-packet.c:983 #9 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc567fff680, pbd=0x7fc028600000) at source-af-packet.c:996 #10 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc567fff680) at source-af-packet.c:1043 #11 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6b01feb20, data=0x7fc567fff680, slot=0x7fc6b78fcdd0) at source-af-packet.c:1393 #12 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6b01feb20) at tm-threads.c:312 #13 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 35 (Thread 0x7fc45bfff700 (LWP 58651)): #0 0x00007fc83071defc in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007fc8307555a5 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x00007fc83065947b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #3 0x0000000000523e86 in SCHSSearch (mpm_ctx=0x7fc6997bba70, mpm_thread_ctx=0x7fc443882828, pmq=0x7fc443882858, buf=0x7fbe67692640 , buflen=1320) at util-mpm-hs.c:946 #4 0x00000000005a22e6 in PrefilterPktStream (det_ctx=0x7fc443882740, p=0x7fc44e4ff660, pectx=0x7fc6997bba70) at detect-engine-payload.c:99 #5 0x00000000005a5b4c in Prefilter (det_ctx=0x7fc443882740, sgh=0x7fc6997c8280, p=0x7fc44e4ff660, flags=4 '\004') at detect-engine-prefilter.c:182 #6 0x00000000006f2620 in DetectRunPrefilterPkt (tv=0x7fc6baac60c0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc443882740, p=0x7fc44e4ff660, scratch=0x7fc45bffe6f0) at detect.c:686 #7 0x00000000006f1d01 in DetectRun (th_v=0x7fc6baac60c0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc443882740, p=0x7fc44e4ff660) at detect.c:132 #8 0x00000000006f19ff in DetectFlow (tv=0x7fc6baac60c0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc443882740, p=0x7fc44e4ff660) at detect.c:1681 #9 0x00000000006f18a8 in Detect (tv=0x7fc6baac60c0, p=0x7fc44e4ff660, data=0x7fc443882740) at detect.c:1753 #10 0x0000000000611758 in FlowWorker (tv=0x7fc6baac60c0, p=0x7fc44e4ff660, data=0x7fc44e53b0f0) at flow-worker.c:552 #11 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6baac60c0, p=0x7fc44e4ff660, slot=0x7fc6a38ce2a0) at tm-threads.c:117 #12 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6baac60c0, s=0x7fc6a38ce2a0, p=0x7fc44e4ff660) at ./tm-threads.h:195 #13 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc453fff680, pbd=0x7fbe67600000, ppd=0x7fbe676925b0) at source-af-packet.c:983 #14 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc453fff680, pbd=0x7fbe67600000) at source-af-packet.c:996 #15 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc453fff680) at source-af-packet.c:1043 #16 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6baac60c0, data=0x7fc453fff680, slot=0x7fc6b6718a70) at source-af-packet.c:1393 #17 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6baac60c0) at tm-threads.c:312 #18 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #19 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 34 (Thread 0x7fc537a74700 (LWP 58638)): #0 0x000000000056072a in StatsAddUI64 (tv=0x7fc6a8025650, id=12, x=89) at counters.c:159 #1 0x0000000000569345 in DecodeUpdatePacketCounters (tv=0x7fc6a8025650, dtv=0x7fc52ffffcc0, p=0x7fc52a4ff660) at decode.c:624 #2 0x0000000000654024 in DecodeAFP (tv=0x7fc6a8025650, p=0x7fc52a4ff660, data=0x7fc52ffffcc0) at source-af-packet.c:2707 #3 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6a8025650, p=0x7fc52a4ff660, slot=0x7fc6b4ce3040) at tm-threads.c:117 #4 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6a8025650, s=0x7fc6b4ce3040, p=0x7fc52a4ff660) at ./tm-threads.h:195 #5 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc52ffff680, pbd=0x7fbfd8000000, ppd=0x7fbfd80db6a0) at source-af-packet.c:983 #6 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc52ffff680, pbd=0x7fbfd8000000) at source-af-packet.c:996 #7 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc52ffff680) at source-af-packet.c:1043 #8 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6a8025650, data=0x7fc52ffff680, slot=0x7fc6b4ce5550) at source-af-packet.c:1393 #9 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6a8025650) at tm-threads.c:312 #10 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #11 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 33 (Thread 0x7fc6209cf700 (LWP 58628)): #0 0x0000000000661b41 in StreamTcpPacket (tv=0x7fc6b4f932c0, p=0x7fc5d64ff660, stt=0x7fc5dffffc70, pq=0x7fc5d653b120) at stream-tcp.c:5035 #1 0x0000000000664136 in StreamTcp (tv=0x7fc6b4f932c0, p=0x7fc5d64ff660, data=0x7fc5dffffc70, pq=0x7fc5d653b120) at stream-tcp.c:5312 #2 0x0000000000611bb3 in FlowWorkerStreamTCPUpdate (tv=0x7fc6b4f932c0, fw=0x7fc5d653b0f0, p=0x7fc5d64ff660, detect_thread=0x7fc5cb882740, timeout=false) at flow-worker.c:370 #3 0x00000000006116d2 in FlowWorker (tv=0x7fc6b4f932c0, p=0x7fc5d64ff660, data=0x7fc5d653b0f0) at flow-worker.c:536 #4 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6b4f932c0, p=0x7fc5d64ff660, slot=0x7fc6a6a6b300) at tm-threads.c:117 #5 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6b4f932c0, s=0x7fc6a6a6b300, p=0x7fc5d64ff660) at ./tm-threads.h:195 #6 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc5dffff680, pbd=0x7fc0f4200000, ppd=0x7fc0f42559a8) at source-af-packet.c:983 #7 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc5dffff680, pbd=0x7fc0f4200000) at source-af-packet.c:996 #8 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc5dffff680) at source-af-packet.c:1043 #9 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6b4f932c0, data=0x7fc5dffff680, slot=0x7fc6a7d62220) at source-af-packet.c:1393 #10 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6b4f932c0) at tm-threads.c:312 #11 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #12 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 32 (Thread 0x7fc5351d0700 (LWP 58641)): #0 0x00000000006f3f02 in DetectPrefilterBuildNonPrefilterList (det_ctx=0x7fc4ef882740, mask=131 '\203', alproto=34 '"') at detect.c:377 #1 0x00000000006f2603 in DetectRunPrefilterPkt (tv=0x7fc6b572d3f0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc4ef882740, p=0x7fc4fa4ff660, scratch=0x7fc5351cf6f0) at detect.c:681 #2 0x00000000006f1d01 in DetectRun (th_v=0x7fc6b572d3f0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc4ef882740, p=0x7fc4fa4ff660) at detect.c:132 #3 0x00000000006f19ff in DetectFlow (tv=0x7fc6b572d3f0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc4ef882740, p=0x7fc4fa4ff660) at detect.c:1681 #4 0x00000000006f18a8 in Detect (tv=0x7fc6b572d3f0, p=0x7fc4fa4ff660, data=0x7fc4ef882740) at detect.c:1753 #5 0x0000000000611758 in FlowWorker (tv=0x7fc6b572d3f0, p=0x7fc4fa4ff660, data=0x7fc4fa53b0f0) at flow-worker.c:552 #6 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6b572d3f0, p=0x7fc4fa4ff660, slot=0x7fc6b9d17640) at tm-threads.c:117 #7 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6b572d3f0, s=0x7fc6b9d17640, p=0x7fc4fa4ff660) at ./tm-threads.h:195 #8 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc503fff680, pbd=0x7fbf7ea00000, ppd=0x7fbf7ea63d88) at source-af-packet.c:983 #9 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc503fff680, pbd=0x7fbf7ea00000) at source-af-packet.c:996 #10 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc503fff680) at source-af-packet.c:1043 #11 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6b572d3f0, data=0x7fc503fff680, slot=0x7fc6b2b174b0) at source-af-packet.c:1393 #12 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6b572d3f0) at tm-threads.c:312 #13 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 31 (Thread 0x7fc49ece8700 (LWP 58648)): #0 0x00007fc830985fc7 in __GI___pthread_mutex_lock (mutex=0x7fc6ea24d478) at ../nptl/pthread_mutex_lock.c:67 #1 0x000000000060904e in FromHashLockTO (f=0x7fc6ea24d3f0) at flow-hash.c:731 #2 0x00000000006089da in FlowGetFlowFromHash (tv=0x7fc6baa70290, fls=0x7fc48253b138, p=0x7fc4824ff660, dest=0x7fc4824ff698) at flow-hash.c:800 #3 0x0000000000605fc2 in FlowHandlePacket (tv=0x7fc6baa70290, fls=0x7fc48253b138, p=0x7fc4824ff660) at flow.c:512 #4 0x000000000061159a in FlowWorker (tv=0x7fc6baa70290, p=0x7fc4824ff660, data=0x7fc48253b0f0) at flow-worker.c:502 #5 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6baa70290, p=0x7fc4824ff660, slot=0x7fc6b9f02e30) at tm-threads.c:117 #6 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6baa70290, s=0x7fc6b9f02e30, p=0x7fc4824ff660) at ./tm-threads.h:195 #7 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc48bfff680, pbd=0x7fbec1600000, ppd=0x7fbec167d0c0) at source-af-packet.c:983 #8 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc48bfff680, pbd=0x7fbec1600000) at source-af-packet.c:996 #9 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc48bfff680) at source-af-packet.c:1043 #10 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6baa70290, data=0x7fc48bfff680, slot=0x7fc6b9ef4000) at source-af-packet.c:1393 #11 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6baa70290) at tm-threads.c:312 #12 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #13 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 30 (Thread 0x7fc5cdf5c700 (LWP 58631)): #0 PacketSetData (p=0x7fc5a24ff660, pktdata=0x7fc08e22b762 , pktlen=405) at decode.c:694 #1 0x000000000065963e in UpdateRawDataForVLANHdr (p=0x7fc5a24ff660) at source-af-packet.c:2681 #2 0x00000000006540c7 in DecodeAFP (tv=0x7fc6bc117300, p=0x7fc5a24ff660, data=0x7fc5abfffcc0) at source-af-packet.c:2714 #3 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6bc117300, p=0x7fc5a24ff660, slot=0x7fc69b130570) at tm-threads.c:117 #4 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6bc117300, s=0x7fc69b130570, p=0x7fc5a24ff660) at ./tm-threads.h:195 #5 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc5abfff680, pbd=0x7fc08e200000, ppd=0x7fc08e22b710) at source-af-packet.c:983 #6 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc5abfff680, pbd=0x7fc08e200000) at source-af-packet.c:996 #7 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc5abfff680) at source-af-packet.c:1043 #8 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6bc117300, data=0x7fc5abfff680, slot=0x7fc6aca67540) at source-af-packet.c:1393 #9 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6bc117300) at tm-threads.c:312 #10 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #11 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 29 (Thread 0x7fc623273700 (LWP 58625)): #0 0x000000000058d9fc in DetectEngineInspectRulePacketMatches (det_ctx=0x7fc5fb882740, engine=0x7fc69f305f70, s=0x7fc6bceff800, p=0x7fc6064ff660, _alert_flags=0x7fc623272677 "") at detect-engine.c:1749 #1 0x000000000058d5d8 in DetectEnginePktInspectionRun (tv=0x7fc6b4f79140, det_ctx=0x7fc5fb882740, s=0x7fc6bceff800, f=0x7fc6bd50f5e0, p=0x7fc6064ff660, alert_flags=0x7fc623272677 "") at detect-engine.c:1814 #2 0x00000000006f28b6 in DetectRulePacketRules (tv=0x7fc6b4f79140, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc5fb882740, p=0x7fc6064ff660, pflow=0x7fc6bd50f5e0, scratch=0x7fc6232726f0) at detect.c:796 #3 0x00000000006f1d1e in DetectRun (th_v=0x7fc6b4f79140, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc5fb882740, p=0x7fc6064ff660) at detect.c:136 #4 0x00000000006f19ff in DetectFlow (tv=0x7fc6b4f79140, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc5fb882740, p=0x7fc6064ff660) at detect.c:1681 #5 0x00000000006f18a8 in Detect (tv=0x7fc6b4f79140, p=0x7fc6064ff660, data=0x7fc5fb882740) at detect.c:1753 #6 0x0000000000611758 in FlowWorker (tv=0x7fc6b4f79140, p=0x7fc6064ff660, data=0x7fc60653b0f0) at flow-worker.c:552 #7 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6b4f79140, p=0x7fc6064ff660, slot=0x7fc6b9b94140) at tm-threads.c:117 #8 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6b4f79140, s=0x7fc6b9b94140, p=0x7fc6064ff660) at ./tm-threads.h:195 #9 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc60ffff680, pbd=0x7fc14ea00000, ppd=0x7fc14ea29de8) at source-af-packet.c:983 #10 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc60ffff680, pbd=0x7fc14ea00000) at source-af-packet.c:996 #11 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc60ffff680) at source-af-packet.c:1043 #12 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6b4f79140, data=0x7fc60ffff680, slot=0x7fc6aa10ab30) at source-af-packet.c:1393 #13 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6b4f79140) at tm-threads.c:312 #14 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #15 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 28 (Thread 0x7fc6224e7700 (LWP 58626)): #0 0x000000000057f201 in DetectAddressMatchIPv4 (addrs=0x7fc6b6e82e80, addrs_cnt=27, a=0x7fc5f64ff660) at detect-engine-address.c:1648 #1 0x00000000006f4941 in DetectRunInspectRuleHeader (p=0x7fc5f64ff660, f=0x7fb5d9249cd0, s=0x7fc6b6e86e00, sflags=9963524, s_proto_flags=0 '\000') at detect.c:650 #2 0x00000000006f288b in DetectRulePacketRules (tv=0x7fc6b4f82e30, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc5eb882740, p=0x7fc5f64ff660, pflow=0x7fb5d9249cd0, scratch=0x7fc6224e66f0) at detect.c:792 #3 0x00000000006f1d1e in DetectRun (th_v=0x7fc6b4f82e30, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc5eb882740, p=0x7fc5f64ff660) at detect.c:136 #4 0x00000000006f19ff in DetectFlow (tv=0x7fc6b4f82e30, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc5eb882740, p=0x7fc5f64ff660) at detect.c:1681 #5 0x00000000006f18a8 in Detect (tv=0x7fc6b4f82e30, p=0x7fc5f64ff660, data=0x7fc5eb882740) at detect.c:1753 #6 0x0000000000611758 in FlowWorker (tv=0x7fc6b4f82e30, p=0x7fc5f64ff660, data=0x7fc5f653b0f0) at flow-worker.c:552 #7 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6b4f82e30, p=0x7fc5f64ff660, slot=0x7fc69eebc880) at tm-threads.c:117 #8 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6b4f82e30, s=0x7fc69eebc880, p=0x7fc5f64ff660) at ./tm-threads.h:195 #9 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc5fffff680, pbd=0x7fc12f600000, ppd=0x7fc12f6b21a8) at source-af-packet.c:983 #10 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc5fffff680, pbd=0x7fc12f600000) at source-af-packet.c:996 #11 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc5fffff680) at source-af-packet.c:1043 #12 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6b4f82e30, data=0x7fc5fffff680, slot=0x7fc6af3177e0) at source-af-packet.c:1393 #13 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6b4f82e30) at tm-threads.c:312 #14 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #15 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 27 (Thread 0x7fc293fff700 (LWP 58678)): #0 DetectRulePacketRules (tv=0x7fc6ba622480, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc27b882740, p=0x7fc2864ff660, pflow=0x7fb52ed06f50, scratch=0x7fc293ffe6f0) at detect.c:808 #1 0x00000000006f1d1e in DetectRun (th_v=0x7fc6ba622480, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc27b882740, p=0x7fc2864ff660) at detect.c:136 #2 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba622480, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc27b882740, p=0x7fc2864ff660) at detect.c:1681 #3 0x00000000006f18a8 in Detect (tv=0x7fc6ba622480, p=0x7fc2864ff660, data=0x7fc27b882740) at detect.c:1753 #4 0x0000000000611758 in FlowWorker (tv=0x7fc6ba622480, p=0x7fc2864ff660, data=0x7fc28653b0f0) at flow-worker.c:552 #5 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba622480, p=0x7fc2864ff660, slot=0x7fc6ba1b2f90) at tm-threads.c:117 #6 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba622480, s=0x7fc6ba1b2f90, p=0x7fc2864ff660) at ./tm-threads.h:195 #7 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc28bfff680, pbd=0x7fbb52e00000, ppd=0x7fbb52e85468) at source-af-packet.c:983 #8 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc28bfff680, pbd=0x7fbb52e00000) at source-af-packet.c:996 #9 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc28bfff680) at source-af-packet.c:1043 #10 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba622480, data=0x7fc28bfff680, slot=0x7fc6b814dce0) at source-af-packet.c:1393 #11 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba622480) at tm-threads.c:312 #12 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #13 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 26 (Thread 0x7fc293273700 (LWP 58679)): #0 0x000000000059729c in IPOnlyMatchPacket (tv=0x7fc6ba647180, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc26b882740, io_ctx=0x7fc6bce67fd0, io_tctx=0x7fc26b882870, p=0x7fc2764ff660) at detect-engine-iponly.c:1044 #1 0x00000000006f2294 in DetectRunInspectIPOnly (tv=0x7fc6ba647180, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc26b882740, pflow=0x7fc6e865fa20, p=0x7fc2764ff660) at detect.c:557 #2 0x00000000006f1cb9 in DetectRun (th_v=0x7fc6ba647180, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc26b882740, p=0x7fc2764ff660) at detect.c:120 #3 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba647180, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc26b882740, p=0x7fc2764ff660) at detect.c:1681 #4 0x00000000006f18a8 in Detect (tv=0x7fc6ba647180, p=0x7fc2764ff660, data=0x7fc26b882740) at detect.c:1753 #5 0x0000000000611758 in FlowWorker (tv=0x7fc6ba647180, p=0x7fc2764ff660, data=0x7fc27653b0f0) at flow-worker.c:552 #6 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba647180, p=0x7fc2764ff660, slot=0x7fc6ba1d9900) at tm-threads.c:117 #7 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba647180, s=0x7fc6ba1d9900, p=0x7fc2764ff660) at ./tm-threads.h:195 #8 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc27ffff680, pbd=0x7fbb45200000, ppd=0x7fbb45218fc8) at source-af-packet.c:983 #9 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc27ffff680, pbd=0x7fbb45200000) at source-af-packet.c:996 #10 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc27ffff680) at source-af-packet.c:1043 #11 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba647180, data=0x7fc27ffff680, slot=0x7fc6ba1c3a60) at source-af-packet.c:1393 #12 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba647180) at tm-threads.c:312 #13 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 25 (Thread 0x7fc3c24e7700 (LWP 58662)): #0 0x00000000006f49bb in DetectRunInspectRuleHeader (p=0x7fc3964ff660, f=0x7fb46a14a970, s=0x7fc6bcf12d00, sflags=1572879, s_proto_flags=1 '\001') at detect.c:659 #1 0x00000000006f288b in DetectRulePacketRules (tv=0x7fc6ba719a10, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc38b882740, p=0x7fc3964ff660, pflow=0x7fb46a14a970, scratch=0x7fc3c24e66f0) at detect.c:792 #2 0x00000000006f1d1e in DetectRun (th_v=0x7fc6ba719a10, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc38b882740, p=0x7fc3964ff660) at detect.c:136 #3 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba719a10, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc38b882740, p=0x7fc3964ff660) at detect.c:1681 #4 0x00000000006f18a8 in Detect (tv=0x7fc6ba719a10, p=0x7fc3964ff660, data=0x7fc38b882740) at detect.c:1753 #5 0x0000000000611758 in FlowWorker (tv=0x7fc6ba719a10, p=0x7fc3964ff660, data=0x7fc39653b0f0) at flow-worker.c:552 #6 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba719a10, p=0x7fc3964ff660, slot=0x7fc69ffc5470) at tm-threads.c:117 #7 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba719a10, s=0x7fc69ffc5470, p=0x7fc3964ff660) at ./tm-threads.h:195 #8 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc39ffff680, pbd=0x7fbd27c00000, ppd=0x7fbd27c0c160) at source-af-packet.c:983 #9 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc39ffff680, pbd=0x7fbd27c00000) at source-af-packet.c:996 #10 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc39ffff680) at source-af-packet.c:1043 #11 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba719a10, data=0x7fc39ffff680, slot=0x7fc6ba0840c0) at source-af-packet.c:1393 #12 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba719a10) at tm-threads.c:312 #13 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 24 (Thread 0x7fc4f09cf700 (LWP 58646)): #0 DetectRulePacketRules (tv=0x7fc6a66a1d00, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc49b882740, p=0x7fc4a64ff660, pflow=0x7fb9b61a6ad0, scratch=0x7fc4f09ce6f0) at detect.c:796 #1 0x00000000006f1d1e in DetectRun (th_v=0x7fc6a66a1d00, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc49b882740, p=0x7fc4a64ff660) at detect.c:136 #2 0x00000000006f19ff in DetectFlow (tv=0x7fc6a66a1d00, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc49b882740, p=0x7fc4a64ff660) at detect.c:1681 #3 0x00000000006f18a8 in Detect (tv=0x7fc6a66a1d00, p=0x7fc4a64ff660, data=0x7fc49b882740) at detect.c:1753 #4 0x0000000000611758 in FlowWorker (tv=0x7fc6a66a1d00, p=0x7fc4a64ff660, data=0x7fc4a653b0f0) at flow-worker.c:552 #5 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6a66a1d00, p=0x7fc4a64ff660, slot=0x7fc6b7a06340) at tm-threads.c:117 #6 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6a66a1d00, s=0x7fc6b7a06340, p=0x7fc4a64ff660) at ./tm-threads.h:195 #7 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc4affff680, pbd=0x7fbef0e00000, ppd=0x7fbef0e66750) at source-af-packet.c:983 #8 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc4affff680, pbd=0x7fbef0e00000) at source-af-packet.c:996 #9 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc4affff680) at source-af-packet.c:1043 #10 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6a66a1d00, data=0x7fc4affff680, slot=0x7fc6b7a06940) at source-af-packet.c:1393 #11 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6a66a1d00) at tm-threads.c:312 #12 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #13 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 23 (Thread 0x7fc665f5c700 (LWP 58622)): #0 0x00007fc830659202 in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x0000000000523e86 in SCHSSearch (mpm_ctx=0x7fc6997cd8f0, mpm_thread_ctx=0x7fc62f882828, pmq=0x7fc62f882858, buf=0x7fc1ac89e210 , buflen=1238) at util-mpm-hs.c:946 #2 0x00000000005a23e8 in PrefilterPktPayload (det_ctx=0x7fc62f882740, p=0x7fc63a4ff660, pectx=0x7fc6997cd8f0) at detect-engine-payload.c:122 #3 0x00000000005a5b4c in Prefilter (det_ctx=0x7fc62f882740, sgh=0x7fc6996706a0, p=0x7fc63a4ff660, flags=8 '\b') at detect-engine-prefilter.c:182 #4 0x00000000006f2620 in DetectRunPrefilterPkt (tv=0x7fc68cf1d770, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc62f882740, p=0x7fc63a4ff660, scratch=0x7fc665f5b6f0) at detect.c:686 #5 0x00000000006f1d01 in DetectRun (th_v=0x7fc68cf1d770, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc62f882740, p=0x7fc63a4ff660) at detect.c:132 #6 0x00000000006f19ff in DetectFlow (tv=0x7fc68cf1d770, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc62f882740, p=0x7fc63a4ff660) at detect.c:1681 #7 0x00000000006f18a8 in Detect (tv=0x7fc68cf1d770, p=0x7fc63a4ff660, data=0x7fc62f882740) at detect.c:1753 #8 0x0000000000611758 in FlowWorker (tv=0x7fc68cf1d770, p=0x7fc63a4ff660, data=0x7fc63a53b0f0) at flow-worker.c:552 #9 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc68cf1d770, p=0x7fc63a4ff660, slot=0x7fc6b9ba8b70) at tm-threads.c:117 #10 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc68cf1d770, s=0x7fc6b9ba8b70, p=0x7fc63a4ff660) at ./tm-threads.h:195 #11 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc643fff680, pbd=0x7fc1ac800000, ppd=0x7fc1ac89e178) at source-af-packet.c:983 #12 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc643fff680, pbd=0x7fc1ac800000) at source-af-packet.c:996 #13 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc643fff680) at source-af-packet.c:1043 #14 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc68cf1d770, data=0x7fc643fff680, slot=0x7fc6b75a8af0) at source-af-packet.c:1393 #15 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc68cf1d770) at tm-threads.c:312 #16 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #17 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 22 (Thread 0x7fc666ce8700 (LWP 58621)): #0 0x00000000005a8a58 in DetectProtoContainsProto (dp=0x7fc6bcf0b972, proto=32710) at detect-engine-proto.c:136 #1 0x00000000006f46bc in DetectRunInspectRuleHeader (p=0x7fc64a4ff660, f=0x7fc6d65e15c0, s=0x7fc6bcf0b960, sflags=1572879, s_proto_flags=1 '\001') at detect.c:607 #2 0x00000000006f288b in DetectRulePacketRules (tv=0x7fc69913e2e0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc63f882740, p=0x7fc64a4ff660, pflow=0x7fc6d65e15c0, scratch=0x7fc666ce76f0) at detect.c:792 #3 0x00000000006f1d1e in DetectRun (th_v=0x7fc69913e2e0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc63f882740, p=0x7fc64a4ff660) at detect.c:136 #4 0x00000000006f19ff in DetectFlow (tv=0x7fc69913e2e0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc63f882740, p=0x7fc64a4ff660) at detect.c:1681 #5 0x00000000006f18a8 in Detect (tv=0x7fc69913e2e0, p=0x7fc64a4ff660, data=0x7fc63f882740) at detect.c:1753 #6 0x0000000000611758 in FlowWorker (tv=0x7fc69913e2e0, p=0x7fc64a4ff660, data=0x7fc64a53b0f0) at flow-worker.c:552 #7 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc69913e2e0, p=0x7fc64a4ff660, slot=0x7fc6b45dfd10) at tm-threads.c:117 #8 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc69913e2e0, s=0x7fc6b45dfd10, p=0x7fc64a4ff660) at ./tm-threads.h:195 #9 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc653fff680, pbd=0x7fc1c3c00000, ppd=0x7fc1c3c015b0) at source-af-packet.c:983 #10 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc653fff680, pbd=0x7fc1c3c00000) at source-af-packet.c:996 #11 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc653fff680) at source-af-packet.c:1043 #12 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc69913e2e0, data=0x7fc653fff680, slot=0x7fc6b763b4e0) at source-af-packet.c:1393 #13 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc69913e2e0) at tm-threads.c:312 #14 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #15 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 21 (Thread 0x7fc62175b700 (LWP 58627)): #0 0x00007fc83076e338 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007fc830669baf in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x00007fc83066ac25 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #3 0x00007fc83075552a in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #4 0x00007fc83065947b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #5 0x0000000000523e86 in SCHSSearch (mpm_ctx=0x7fc6997c55d0, mpm_thread_ctx=0x7fc5db882828, pmq=0x7fc5db882858, buf=0x7fc110250fe8 , buflen=1448) at util-mpm-hs.c:946 #6 0x00000000005a23e8 in PrefilterPktPayload (det_ctx=0x7fc5db882740, p=0x7fc5e64ff660, pectx=0x7fc6997c55d0) at detect-engine-payload.c:122 #7 0x00000000005a5b4c in Prefilter (det_ctx=0x7fc5db882740, sgh=0x7fc6997c8280, p=0x7fc5e64ff660, flags=4 '\004') at detect-engine-prefilter.c:182 #8 0x00000000006f2620 in DetectRunPrefilterPkt (tv=0x7fc6b4f82a70, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc5db882740, p=0x7fc5e64ff660, scratch=0x7fc62175a6f0) at detect.c:686 #9 0x00000000006f1d01 in DetectRun (th_v=0x7fc6b4f82a70, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc5db882740, p=0x7fc5e64ff660) at detect.c:132 #10 0x00000000006f19ff in DetectFlow (tv=0x7fc6b4f82a70, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc5db882740, p=0x7fc5e64ff660) at detect.c:1681 #11 0x00000000006f18a8 in Detect (tv=0x7fc6b4f82a70, p=0x7fc5e64ff660, data=0x7fc5db882740) at detect.c:1753 #12 0x0000000000611758 in FlowWorker (tv=0x7fc6b4f82a70, p=0x7fc5e64ff660, data=0x7fc5e653b0f0) at flow-worker.c:552 #13 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6b4f82a70, p=0x7fc5e64ff660, slot=0x7fc6b9b876b0) at tm-threads.c:117 #14 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6b4f82a70, s=0x7fc6b9b876b0, p=0x7fc5e64ff660) at ./tm-threads.h:195 #15 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc5effff680, pbd=0x7fc110200000, ppd=0x7fc110250f50) at source-af-packet.c:983 #16 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc5effff680, pbd=0x7fc110200000) at source-af-packet.c:996 #17 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc5effff680) at source-af-packet.c:1043 #18 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6b4f82a70, data=0x7fc5effff680, slot=0x7fc6b1557370) at source-af-packet.c:1393 #19 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6b4f82a70) at tm-threads.c:312 #20 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #21 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 20 (Thread 0x7fc32975b700 (LWP 58672)): #0 DetectVarProcessList (det_ctx=0x7fc2e3882740, f=0x7fc6bd1743f0, p=0x7fc2ee4ff660) at ./detect-flowvar.h:48 #1 0x00000000006f290b in DetectRulePacketRules (tv=0x7fc6ba5b5840, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc2e3882740, p=0x7fc2ee4ff660, pflow=0x7fc6bd1743f0, scratch=0x7fc32975a6f0) at detect.c:807 #2 0x00000000006f1d1e in DetectRun (th_v=0x7fc6ba5b5840, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc2e3882740, p=0x7fc2ee4ff660) at detect.c:136 #3 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba5b5840, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc2e3882740, p=0x7fc2ee4ff660) at detect.c:1681 #4 0x00000000006f18a8 in Detect (tv=0x7fc6ba5b5840, p=0x7fc2ee4ff660, data=0x7fc2e3882740) at detect.c:1753 #5 0x0000000000611758 in FlowWorker (tv=0x7fc6ba5b5840, p=0x7fc2ee4ff660, data=0x7fc2ee53b0f0) at flow-worker.c:552 #6 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba5b5840, p=0x7fc2ee4ff660, slot=0x7fc6ba23b4c0) at tm-threads.c:117 #7 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba5b5840, s=0x7fc6ba23b4c0, p=0x7fc2ee4ff660) at ./tm-threads.h:195 #8 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc2f7fff680, pbd=0x7fbc0d800000, ppd=0x7fbc0d8c2f28) at source-af-packet.c:983 #9 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc2f7fff680, pbd=0x7fbc0d800000) at source-af-packet.c:996 #10 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc2f7fff680) at source-af-packet.c:1043 #11 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba5b5840, data=0x7fc2f7fff680, slot=0x7fc6ae096cf0) at source-af-packet.c:1393 #12 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba5b5840) at tm-threads.c:312 #13 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 19 (Thread 0x7fc5cd1d0700 (LWP 58632)): #0 0x00000000006f4af8 in DetectReplaceFree (det_ctx=0x7fc587882740) at ./detect-replace.h:35 #1 0x00000000006f2914 in DetectRulePacketRules (tv=0x7fc6a1b6d7f0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc587882740, p=0x7fc5924ff660, pflow=0x7fc6bde0ac30, scratch=0x7fc5cd1cf6f0) at detect.c:808 #2 0x00000000006f1d1e in DetectRun (th_v=0x7fc6a1b6d7f0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc587882740, p=0x7fc5924ff660) at detect.c:136 #3 0x00000000006f19ff in DetectFlow (tv=0x7fc6a1b6d7f0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc587882740, p=0x7fc5924ff660) at detect.c:1681 #4 0x00000000006f18a8 in Detect (tv=0x7fc6a1b6d7f0, p=0x7fc5924ff660, data=0x7fc587882740) at detect.c:1753 #5 0x0000000000611758 in FlowWorker (tv=0x7fc6a1b6d7f0, p=0x7fc5924ff660, data=0x7fc59253b0f0) at flow-worker.c:552 #6 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6a1b6d7f0, p=0x7fc5924ff660, slot=0x7fc6b791ef80) at tm-threads.c:117 #7 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6a1b6d7f0, s=0x7fc6b791ef80, p=0x7fc5924ff660) at ./tm-threads.h:195 #8 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc59bfff680, pbd=0x7fc084000000, ppd=0x7fc08404a268) at source-af-packet.c:983 #9 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc59bfff680, pbd=0x7fc084000000) at source-af-packet.c:996 #10 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc59bfff680) at source-af-packet.c:1043 #11 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6a1b6d7f0, data=0x7fc59bfff680, slot=0x7fc6aa255030) at source-af-packet.c:1393 #12 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6a1b6d7f0) at tm-threads.c:312 #13 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 18 (Thread 0x7fc535f5c700 (LWP 58640)): #0 0x0000000000705994 in DetectEngineEventMatch (det_ctx=0x7fc4ff882740, p=0x7fc50a4ff660, s=0x7fc6bcf07900, ctx=0x7fc7f1412fd0) at detect-engine-event.c:100 #1 0x000000000058da18 in DetectEngineInspectRulePacketMatches (det_ctx=0x7fc4ff882740, engine=0x7fc69f2eb8c0, s=0x7fc6bcf085e0, p=0x7fc50a4ff660, _alert_flags=0x7fc535f5b677 "") at detect-engine.c:1749 #2 0x000000000058d5d8 in DetectEnginePktInspectionRun (tv=0x7fc6a79211c0, det_ctx=0x7fc4ff882740, s=0x7fc6bcf085e0, f=0x7fb5dbcfb400, p=0x7fc50a4ff660, alert_flags=0x7fc535f5b677 "") at detect-engine.c:1814 #3 0x00000000006f28b6 in DetectRulePacketRules (tv=0x7fc6a79211c0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc4ff882740, p=0x7fc50a4ff660, pflow=0x7fb5dbcfb400, scratch=0x7fc535f5b6f0) at detect.c:796 #4 0x00000000006f1d1e in DetectRun (th_v=0x7fc6a79211c0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc4ff882740, p=0x7fc50a4ff660) at detect.c:136 #5 0x00000000006f19ff in DetectFlow (tv=0x7fc6a79211c0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc4ff882740, p=0x7fc50a4ff660) at detect.c:1681 #6 0x00000000006f18a8 in Detect (tv=0x7fc6a79211c0, p=0x7fc50a4ff660, data=0x7fc4ff882740) at detect.c:1753 #7 0x0000000000611758 in FlowWorker (tv=0x7fc6a79211c0, p=0x7fc50a4ff660, data=0x7fc50a53b0f0) at flow-worker.c:552 #8 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6a79211c0, p=0x7fc50a4ff660, slot=0x7fc6a6aa6cd0) at tm-threads.c:117 #9 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6a79211c0, s=0x7fc6a6aa6cd0, p=0x7fc50a4ff660) at ./tm-threads.h:195 #10 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc513fff680, pbd=0x7fbf99000000, ppd=0x7fbf99091c00) at source-af-packet.c:983 #11 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc513fff680, pbd=0x7fbf99000000) at source-af-packet.c:996 #12 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc513fff680) at source-af-packet.c:1043 #13 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6a79211c0, data=0x7fc513fff680, slot=0x7fc6aeae6c00) at source-af-packet.c:1393 #14 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6a79211c0) at tm-threads.c:312 #15 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #16 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 17 (Thread 0x7fc58b273700 (LWP 58634)): #0 DetectRulePacketRules (tv=0x7fc6a1bdafd0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc563882740, p=0x7fc56e4ff660, pflow=0x7fb9b800beb0, scratch=0x7fc58b2726f0) at detect.c:811 #1 0x00000000006f1d1e in DetectRun (th_v=0x7fc6a1bdafd0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc563882740, p=0x7fc56e4ff660) at detect.c:136 #2 0x00000000006f19ff in DetectFlow (tv=0x7fc6a1bdafd0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc563882740, p=0x7fc56e4ff660) at detect.c:1681 #3 0x00000000006f18a8 in Detect (tv=0x7fc6a1bdafd0, p=0x7fc56e4ff660, data=0x7fc563882740) at detect.c:1753 #4 0x0000000000611758 in FlowWorker (tv=0x7fc6a1bdafd0, p=0x7fc56e4ff660, data=0x7fc56e53b0f0) at flow-worker.c:552 #5 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6a1bdafd0, p=0x7fc56e4ff660, slot=0x7fc6b9d8b840) at tm-threads.c:117 #6 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6a1bdafd0, s=0x7fc6b9d8b840, p=0x7fc56e4ff660) at ./tm-threads.h:195 #7 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc577fff680, pbd=0x7fc03f200000, ppd=0x7fc03f204bf8) at source-af-packet.c:983 #8 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc577fff680, pbd=0x7fc03f200000) at source-af-packet.c:996 #9 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc577fff680) at source-af-packet.c:1043 #10 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6a1bdafd0, data=0x7fc577fff680, slot=0x7fc6aa54f070) at source-af-packet.c:1393 #11 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6a1bdafd0) at tm-threads.c:312 #12 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #13 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 16 (Thread 0x7fc2d51d0700 (LWP 58677)): #0 0x000000000058d9f3 in DetectEngineInspectRulePacketMatches (det_ctx=0x7fc28f882740, engine=0x7fc69f2f0940, s=0x7fc6bcf0eca0, p=0x7fc29a4ff660, _alert_flags=0x7fc2d51cf677 "") at detect-engine.c:1749 #1 0x000000000058d5d8 in DetectEnginePktInspectionRun (tv=0x7fc6ba5f7a90, det_ctx=0x7fc28f882740, s=0x7fc6bcf0eca0, f=0x7facda07bc40, p=0x7fc29a4ff660, alert_flags=0x7fc2d51cf677 "") at detect-engine.c:1814 #2 0x00000000006f28b6 in DetectRulePacketRules (tv=0x7fc6ba5f7a90, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc28f882740, p=0x7fc29a4ff660, pflow=0x7facda07bc40, scratch=0x7fc2d51cf6f0) at detect.c:796 #3 0x00000000006f1d1e in DetectRun (th_v=0x7fc6ba5f7a90, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc28f882740, p=0x7fc29a4ff660) at detect.c:136 #4 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba5f7a90, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc28f882740, p=0x7fc29a4ff660) at detect.c:1681 #5 0x00000000006f18a8 in Detect (tv=0x7fc6ba5f7a90, p=0x7fc29a4ff660, data=0x7fc28f882740) at detect.c:1753 #6 0x0000000000611758 in FlowWorker (tv=0x7fc6ba5f7a90, p=0x7fc29a4ff660, data=0x7fc29a53b0f0) at flow-worker.c:552 #7 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba5f7a90, p=0x7fc29a4ff660, slot=0x7fc6b801bc30) at tm-threads.c:117 #8 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba5f7a90, s=0x7fc6b801bc30, p=0x7fc29a4ff660) at ./tm-threads.h:195 #9 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc2a3fff680, pbd=0x7fbb7da00000, ppd=0x7fbb7da58130) at source-af-packet.c:983 #10 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc2a3fff680, pbd=0x7fbb7da00000) at source-af-packet.c:996 #11 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc2a3fff680) at source-af-packet.c:1043 #12 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba5f7a90, data=0x7fc2a3fff680, slot=0x7fc6ac0f9430) at source-af-packet.c:1393 #13 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba5f7a90) at tm-threads.c:312 #14 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #15 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 15 (Thread 0x7fc6651d0700 (LWP 58623)): #0 0x00000000006f2735 in DetectRulePacketRules (tv=0x7fc687e78ed0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc61f882740, p=0x7fc62a4ff660, pflow=0x7fb878f031f0, scratch=0x7fc6651cf6f0) at detect.c:754 #1 0x00000000006f1d1e in DetectRun (th_v=0x7fc687e78ed0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc61f882740, p=0x7fc62a4ff660) at detect.c:136 #2 0x00000000006f19ff in DetectFlow (tv=0x7fc687e78ed0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc61f882740, p=0x7fc62a4ff660) at detect.c:1681 #3 0x00000000006f18a8 in Detect (tv=0x7fc687e78ed0, p=0x7fc62a4ff660, data=0x7fc61f882740) at detect.c:1753 #4 0x0000000000611758 in FlowWorker (tv=0x7fc687e78ed0, p=0x7fc62a4ff660, data=0x7fc62a53b0f0) at flow-worker.c:552 #5 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc687e78ed0, p=0x7fc62a4ff660, slot=0x7fc6acec89f0) at tm-threads.c:117 #6 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc687e78ed0, s=0x7fc6acec89f0, p=0x7fc62a4ff660) at ./tm-threads.h:195 #7 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc633fff680, pbd=0x7fc188800000, ppd=0x7fc1888aa360) at source-af-packet.c:983 #8 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc633fff680, pbd=0x7fc188800000) at source-af-packet.c:996 #9 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc633fff680) at source-af-packet.c:1043 #10 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc687e78ed0, data=0x7fc633fff680, slot=0x7fc6b75e2770) at source-af-packet.c:1393 #11 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc687e78ed0) at tm-threads.c:312 #12 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #13 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 14 (Thread 0x7fc684b34700 (LWP 58619)): #0 0x00007fc83071df3c in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007fc8307555a5 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x00007fc83065947b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #3 0x0000000000523e86 in SCHSSearch (mpm_ctx=0x7fc6997c55d0, mpm_thread_ctx=0x7fc663882848, pmq=0x7fc663882878, buf=0x7fc1e9a02d2c , buflen=1380) at util-mpm-hs.c:946 #4 0x00000000005a23e8 in PrefilterPktPayload (det_ctx=0x7fc663882760, p=0x7fc66e4ff660, pectx=0x7fc6997c55d0) at detect-engine-payload.c:122 #5 0x00000000005a5b4c in Prefilter (det_ctx=0x7fc663882760, sgh=0x7fc6997c8280, p=0x7fc66e4ff660, flags=4 '\004') at detect-engine-prefilter.c:182 #6 0x00000000006f2620 in DetectRunPrefilterPkt (tv=0x7fc699406e20, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc663882760, p=0x7fc66e4ff660, scratch=0x7fc684b336f0) at detect.c:686 #7 0x00000000006f1d01 in DetectRun (th_v=0x7fc699406e20, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc663882760, p=0x7fc66e4ff660) at detect.c:132 #8 0x00000000006f19ff in DetectFlow (tv=0x7fc699406e20, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc663882760, p=0x7fc66e4ff660) at detect.c:1681 #9 0x00000000006f18a8 in Detect (tv=0x7fc699406e20, p=0x7fc66e4ff660, data=0x7fc663882760) at detect.c:1753 #10 0x0000000000611758 in FlowWorker (tv=0x7fc699406e20, p=0x7fc66e4ff660, data=0x7fc66e53b0f0) at flow-worker.c:552 #11 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc699406e20, p=0x7fc66e4ff660, slot=0x7fc698f8e180) at tm-threads.c:117 #12 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc699406e20, s=0x7fc698f8e180, p=0x7fc66e4ff660) at ./tm-threads.h:195 #13 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc677fff680, pbd=0x7fc1e9a00000, ppd=0x7fc1e9a02ca0) at source-af-packet.c:983 #14 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc677fff680, pbd=0x7fc1e9a00000) at source-af-packet.c:996 #15 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc677fff680) at source-af-packet.c:1043 #16 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc699406e20, data=0x7fc677fff680, slot=0x7fc699012580) at source-af-packet.c:1393 #17 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc699406e20) at tm-threads.c:312 #18 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #19 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 13 (Thread 0x7fc36df5c700 (LWP 58667)): #0 0x00007fc830668506 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007fc83066ac25 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x00007fc83075552a in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #3 0x00007fc83065947b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #4 0x0000000000523e86 in SCHSSearch (mpm_ctx=0x7fc699966b30, mpm_thread_ctx=0x7fc337882828, pmq=0x7fc337882858, buf=0x7fbc9001a0b0 , buflen=635) at util-mpm-hs.c:946 #5 0x00000000005a23e8 in PrefilterPktPayload (det_ctx=0x7fc337882740, p=0x7fc3424ff660, pectx=0x7fc699966b30) at detect-engine-payload.c:122 #6 0x00000000005a5b4c in Prefilter (det_ctx=0x7fc337882740, sgh=0x7fc699674880, p=0x7fc3424ff660, flags=4 '\004') at detect-engine-prefilter.c:182 #7 0x00000000006f2620 in DetectRunPrefilterPkt (tv=0x7fc6ba79f190, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc337882740, p=0x7fc3424ff660, scratch=0x7fc36df5b6f0) at detect.c:686 #8 0x00000000006f1d01 in DetectRun (th_v=0x7fc6ba79f190, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc337882740, p=0x7fc3424ff660) at detect.c:132 #9 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba79f190, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc337882740, p=0x7fc3424ff660) at detect.c:1681 #10 0x00000000006f18a8 in Detect (tv=0x7fc6ba79f190, p=0x7fc3424ff660, data=0x7fc337882740) at detect.c:1753 #11 0x0000000000611758 in FlowWorker (tv=0x7fc6ba79f190, p=0x7fc3424ff660, data=0x7fc34253b0f0) at flow-worker.c:552 #12 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba79f190, p=0x7fc3424ff660, slot=0x7fc69c693a90) at tm-threads.c:117 #13 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba79f190, s=0x7fc69c693a90, p=0x7fc3424ff660) at ./tm-threads.h:195 #14 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc34bfff680, pbd=0x7fbc90000000, ppd=0x7fbc9001a030) at source-af-packet.c:983 #15 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc34bfff680, pbd=0x7fbc90000000) at source-af-packet.c:996 #16 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc34bfff680) at source-af-packet.c:1043 #17 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba79f190, data=0x7fc34bfff680, slot=0x7fc6b7e6b670) at source-af-packet.c:1393 #18 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba79f190) at tm-threads.c:312 #19 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #20 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 12 (Thread 0x7fc3c09cf700 (LWP 58664)): #0 0x000000000065583d in AFPParsePacketV3 (ptv=0x7fc37ffff680, pbd=0x7fbce3000000, ppd=0x7fbce30af9b8) at source-af-packet.c:963 #1 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc37ffff680, pbd=0x7fbce3000000) at source-af-packet.c:996 #2 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc37ffff680) at source-af-packet.c:1043 #3 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba748250, data=0x7fc37ffff680, slot=0x7fc6ba070e30) at source-af-packet.c:1393 #4 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba748250) at tm-threads.c:312 #5 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #6 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 11 (Thread 0x7fc3289cf700 (LWP 58673)): #0 0x00000000006f2735 in DetectRulePacketRules (tv=0x7fc6ba5d4780, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc2d3882740, p=0x7fc2de4ff660, pflow=0x7fb1e24c7260, scratch=0x7fc3289ce6f0) at detect.c:754 #1 0x00000000006f1d1e in DetectRun (th_v=0x7fc6ba5d4780, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc2d3882740, p=0x7fc2de4ff660) at detect.c:136 #2 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba5d4780, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc2d3882740, p=0x7fc2de4ff660) at detect.c:1681 #3 0x00000000006f18a8 in Detect (tv=0x7fc6ba5d4780, p=0x7fc2de4ff660, data=0x7fc2d3882740) at detect.c:1753 #4 0x0000000000611758 in FlowWorker (tv=0x7fc6ba5d4780, p=0x7fc2de4ff660, data=0x7fc2de53b0f0) at flow-worker.c:552 #5 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba5d4780, p=0x7fc2de4ff660, slot=0x7fc69e2edc70) at tm-threads.c:117 #6 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba5d4780, s=0x7fc69e2edc70, p=0x7fc2de4ff660) at ./tm-threads.h:195 #7 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc2e7fff680, pbd=0x7fbbe4800000, ppd=0x7fbbe499a598) at source-af-packet.c:983 #8 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc2e7fff680, pbd=0x7fbbe4800000) at source-af-packet.c:996 #9 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc2e7fff680) at source-af-packet.c:1043 #10 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba5d4780, data=0x7fc2e7fff680, slot=0x7fc6ba238f00) at source-af-packet.c:1393 #11 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba5d4780) at tm-threads.c:312 #12 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #13 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 10 (Thread 0x7fc82faa5ac0 (LWP 58614)): #0 0x00007fc82fdaa3bf in __GI___clock_nanosleep (clock_id=clock_id@entry=0, flags=flags@entry=0, req=req@entry=0x7fffb5e2e6b0, rem=rem@entry=0x0) at ../sysdeps/unix/sysv/linux/clock_nanosleep.c:78 #1 0x00007fc82fdb0047 in __GI___nanosleep (requested_time=requested_time@entry=0x7fffb5e2e6b0, remaining=remaining@entry=0x0) at nanosleep.c:27 #2 0x00007fc82fde29bf in usleep (useconds=) at ../sysdeps/posix/usleep.c:32 #3 0x00000000004fdd08 in SuricataMainLoop (suri=0xd3c000 ) at suricata.c:2767 #4 0x00000000004faf0c in SuricataMain (argc=7, argv=0x7fffb5e2e878) at suricata.c:2935 #5 0x00000000004f91e2 in main (argc=7, argv=0x7fffb5e2e878) at main.c:22 Thread 9 (Thread 0x7fc58bfff700 (LWP 58633)): #0 0x00007fc830659202 in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x0000000000523e86 in SCHSSearch (mpm_ctx=0x7fc69977d520, mpm_thread_ctx=0x7fc573882828, pmq=0x7fc573882858, buf=0x7fc05c4783c0 , buflen=624) at util-mpm-hs.c:946 #2 0x00000000005a22e6 in PrefilterPktStream (det_ctx=0x7fc573882740, p=0x7fc57e4ff660, pectx=0x7fc69977d520) at detect-engine-payload.c:99 #3 0x00000000005a5b4c in Prefilter (det_ctx=0x7fc573882740, sgh=0x7fc6991f2b30, p=0x7fc57e4ff660, flags=8 '\b') at detect-engine-prefilter.c:182 #4 0x00000000006f2620 in DetectRunPrefilterPkt (tv=0x7fc6bac50b40, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc573882740, p=0x7fc57e4ff660, scratch=0x7fc58bffe6f0) at detect.c:686 #5 0x00000000006f1d01 in DetectRun (th_v=0x7fc6bac50b40, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc573882740, p=0x7fc57e4ff660) at detect.c:132 #6 0x00000000006f19ff in DetectFlow (tv=0x7fc6bac50b40, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc573882740, p=0x7fc57e4ff660) at detect.c:1681 #7 0x00000000006f18a8 in Detect (tv=0x7fc6bac50b40, p=0x7fc57e4ff660, data=0x7fc573882740) at detect.c:1753 #8 0x0000000000611758 in FlowWorker (tv=0x7fc6bac50b40, p=0x7fc57e4ff660, data=0x7fc57e53b0f0) at flow-worker.c:552 #9 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6bac50b40, p=0x7fc57e4ff660, slot=0x7fc6b2b3f970) at tm-threads.c:117 #10 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6bac50b40, s=0x7fc6b2b3f970, p=0x7fc57e4ff660) at ./tm-threads.h:195 #11 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc583fff680, pbd=0x7fc05c400000, ppd=0x7fc05c478330) at source-af-packet.c:983 #12 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc583fff680, pbd=0x7fc05c400000) at source-af-packet.c:996 #13 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc583fff680) at source-af-packet.c:1043 #14 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6bac50b40, data=0x7fc583fff680, slot=0x7fc6a36d2840) at source-af-packet.c:1393 #15 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6bac50b40) at tm-threads.c:312 #16 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #17 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 8 (Thread 0x7fc405f5c700 (LWP 58658)): #0 0x000000000058da02 in DetectEngineInspectRulePacketMatches (det_ctx=0x7fc3cf882740, engine=0x7fc69f2f18e0, s=0x7fc6bcefde40, p=0x7fc3da4ff660, _alert_flags=0x7fc405f5b677 "") at detect-engine.c:1749 #1 0x000000000058d5d8 in DetectEnginePktInspectionRun (tv=0x7fc6ba925500, det_ctx=0x7fc3cf882740, s=0x7fc6bcefde40, f=0x7fb5e21760b0, p=0x7fc3da4ff660, alert_flags=0x7fc405f5b677 "") at detect-engine.c:1814 #2 0x00000000006f28b6 in DetectRulePacketRules (tv=0x7fc6ba925500, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc3cf882740, p=0x7fc3da4ff660, pflow=0x7fb5e21760b0, scratch=0x7fc405f5b6f0) at detect.c:796 #3 0x00000000006f1d1e in DetectRun (th_v=0x7fc6ba925500, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc3cf882740, p=0x7fc3da4ff660) at detect.c:136 #4 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba925500, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc3cf882740, p=0x7fc3da4ff660) at detect.c:1681 #5 0x00000000006f18a8 in Detect (tv=0x7fc6ba925500, p=0x7fc3da4ff660, data=0x7fc3cf882740) at detect.c:1753 #6 0x0000000000611758 in FlowWorker (tv=0x7fc6ba925500, p=0x7fc3da4ff660, data=0x7fc3da53b0f0) at flow-worker.c:552 #7 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba925500, p=0x7fc3da4ff660, slot=0x7fc6acc936c0) at tm-threads.c:117 #8 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba925500, s=0x7fc6acc936c0, p=0x7fc3da4ff660) at ./tm-threads.h:195 #9 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc3e3fff680, pbd=0x7fbd9be00000, ppd=0x7fbd9be4ca50) at source-af-packet.c:983 #10 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc3e3fff680, pbd=0x7fbd9be00000) at source-af-packet.c:996 #11 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc3e3fff680) at source-af-packet.c:1043 #12 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba925500, data=0x7fc3e3fff680, slot=0x7fc6b30d06f0) at source-af-packet.c:1393 #13 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba925500) at tm-threads.c:312 #14 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #15 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 7 (Thread 0x7fc36d1d0700 (LWP 58668)): #0 0x00000000006f4337 in DetectPrefilterMergeSort (de_ctx=0x7fc6bce66f30, det_ctx=0x7fc327882740) at detect.c:353 #1 0x00000000006f264f in DetectRunPrefilterPkt (tv=0x7fc6ba7a7780, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc327882740, p=0x7fc3324ff660, scratch=0x7fc36d1cf6f0) at detect.c:695 #2 0x00000000006f1d01 in DetectRun (th_v=0x7fc6ba7a7780, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc327882740, p=0x7fc3324ff660) at detect.c:132 #3 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba7a7780, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc327882740, p=0x7fc3324ff660) at detect.c:1681 #4 0x00000000006f18a8 in Detect (tv=0x7fc6ba7a7780, p=0x7fc3324ff660, data=0x7fc327882740) at detect.c:1753 #5 0x0000000000611758 in FlowWorker (tv=0x7fc6ba7a7780, p=0x7fc3324ff660, data=0x7fc33253b0f0) at flow-worker.c:552 #6 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba7a7780, p=0x7fc3324ff660, slot=0x7fc6ba016de0) at tm-threads.c:117 #7 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba7a7780, s=0x7fc6ba016de0, p=0x7fc3324ff660) at ./tm-threads.h:195 #8 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc33bfff680, pbd=0x7fbc7e400000, ppd=0x7fbc7e4d99c0) at source-af-packet.c:983 #9 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc33bfff680, pbd=0x7fbc7e400000) at source-af-packet.c:996 #10 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc33bfff680) at source-af-packet.c:1043 #11 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba7a7780, data=0x7fc33bfff680, slot=0x7fc6a5f0cbd0) at source-af-packet.c:1393 #12 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba7a7780) at tm-threads.c:312 #13 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 6 (Thread 0x7fc667a74700 (LWP 58620)): #0 0x00007fc830757344 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007fc83065947b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x0000000000523e86 in SCHSSearch (mpm_ctx=0x7fc6997c55d0, mpm_thread_ctx=0x7fc64f882848, pmq=0x7fc64f882878, buf=0x7fc1d98449dc , buflen=75) at util-mpm-hs.c:946 #3 0x00000000005a23e8 in PrefilterPktPayload (det_ctx=0x7fc64f882760, p=0x7fc65a4ff660, pectx=0x7fc6997c55d0) at detect-engine-payload.c:122 #4 0x00000000005a5b4c in Prefilter (det_ctx=0x7fc64f882760, sgh=0x7fc6997c8280, p=0x7fc65a4ff660, flags=4 '\004') at detect-engine-prefilter.c:182 #5 0x00000000006f2620 in DetectRunPrefilterPkt (tv=0x7fc68d255930, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc64f882760, p=0x7fc65a4ff660, scratch=0x7fc667a736f0) at detect.c:686 #6 0x00000000006f1d01 in DetectRun (th_v=0x7fc68d255930, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc64f882760, p=0x7fc65a4ff660) at detect.c:132 #7 0x00000000006f19ff in DetectFlow (tv=0x7fc68d255930, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc64f882760, p=0x7fc65a4ff660) at detect.c:1681 #8 0x00000000006f18a8 in Detect (tv=0x7fc68d255930, p=0x7fc65a4ff660, data=0x7fc64f882760) at detect.c:1753 #9 0x0000000000611758 in FlowWorker (tv=0x7fc68d255930, p=0x7fc65a4ff660, data=0x7fc65a53b0f0) at flow-worker.c:552 #10 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc68d255930, p=0x7fc65a4ff660, slot=0x7fc6a7226610) at tm-threads.c:117 #11 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc68d255930, s=0x7fc6a7226610, p=0x7fc65a4ff660) at ./tm-threads.h:195 #12 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc65ffff680, pbd=0x7fc1d9800000, ppd=0x7fc1d9844950) at source-af-packet.c:983 #13 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc65ffff680, pbd=0x7fc1d9800000) at source-af-packet.c:996 #14 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc65ffff680) at source-af-packet.c:1043 #15 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc68d255930, data=0x7fc65ffff680, slot=0x7fc6a342b530) at source-af-packet.c:1393 #16 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc68d255930) at tm-threads.c:312 #17 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #18 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 5 (Thread 0x7fc6858c0700 (LWP 58618)): #0 0x00007fc83071deee in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007fc8307555a5 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x00007fc83065947b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #3 0x0000000000523e86 in SCHSSearch (mpm_ctx=0x7fc69973ae80, mpm_thread_ctx=0x7fc673885a28, pmq=0x7fc673885a58, buf=0x7fc204205a60 , buflen=102) at util-mpm-hs.c:946 #4 0x00000000005a23e8 in PrefilterPktPayload (det_ctx=0x7fc673885940, p=0x7fc67e4ff660, pectx=0x7fc69973ae80) at detect-engine-payload.c:122 #5 0x00000000005a5b4c in Prefilter (det_ctx=0x7fc673885940, sgh=0x7fc698f20bf0, p=0x7fc67e4ff660, flags=8 '\b') at detect-engine-prefilter.c:182 #6 0x00000000006f2620 in DetectRunPrefilterPkt (tv=0x7fc699406f50, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc673885940, p=0x7fc67e4ff660, scratch=0x7fc6858bf6f0) at detect.c:686 #7 0x00000000006f1d01 in DetectRun (th_v=0x7fc699406f50, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc673885940, p=0x7fc67e4ff660) at detect.c:132 #8 0x00000000006f19ff in DetectFlow (tv=0x7fc699406f50, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc673885940, p=0x7fc67e4ff660) at detect.c:1681 #9 0x00000000006f18a8 in Detect (tv=0x7fc699406f50, p=0x7fc67e4ff660, data=0x7fc673885940) at detect.c:1753 #10 0x0000000000611758 in FlowWorker (tv=0x7fc699406f50, p=0x7fc67e4ff660, data=0x7fc67e53e150) at flow-worker.c:552 #11 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc699406f50, p=0x7fc67e4ff660, slot=0x7fc6992ac5d0) at tm-threads.c:117 #12 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc699406f50, s=0x7fc6992ac5d0, p=0x7fc67e4ff660) at ./tm-threads.h:195 #13 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc683fff680, pbd=0x7fc204200000, ppd=0x7fc2042059e0) at source-af-packet.c:983 #14 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc683fff680, pbd=0x7fc204200000) at source-af-packet.c:996 #15 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc683fff680) at source-af-packet.c:1043 #16 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc699406f50, data=0x7fc683fff680, slot=0x7fc698faf4f0) at source-af-packet.c:1393 #17 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc699406f50) at tm-threads.c:312 #18 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #19 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 4 (Thread 0x7fc32a4e7700 (LWP 58671)): #0 0x0000000000608f7c in FlowIsTimedOut (f=0x7fb9b4b09970, sec=1645194698, emerg=false) at flow-hash.c:712 #1 0x00000000006089bc in FlowGetFlowFromHash (tv=0x7fc6ba5a3b30, fls=0x7fc2fe53b138, p=0x7fc2fe4ff660, dest=0x7fc2fe4ff698) at flow-hash.c:798 #2 0x0000000000605fc2 in FlowHandlePacket (tv=0x7fc6ba5a3b30, fls=0x7fc2fe53b138, p=0x7fc2fe4ff660) at flow.c:512 #3 0x000000000061159a in FlowWorker (tv=0x7fc6ba5a3b30, p=0x7fc2fe4ff660, data=0x7fc2fe53b0f0) at flow-worker.c:502 #4 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba5a3b30, p=0x7fc2fe4ff660, slot=0x7fc6b2c7bd90) at tm-threads.c:117 #5 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba5a3b30, s=0x7fc6b2c7bd90, p=0x7fc2fe4ff660) at ./tm-threads.h:195 #6 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc307fff680, pbd=0x7fbc0fe00000, ppd=0x7fbc0fe1dc08) at source-af-packet.c:983 #7 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc307fff680, pbd=0x7fbc0fe00000) at source-af-packet.c:996 #8 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc307fff680) at source-af-packet.c:1043 #9 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba5a3b30, data=0x7fc307fff680, slot=0x7fc6a3805460) at source-af-packet.c:1393 #10 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba5a3b30) at tm-threads.c:312 #11 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #12 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 3 (Thread 0x7fc4f3fff700 (LWP 58642)): #0 0x00007fc8306685ba in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007fc83066ac25 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x00007fc83075552a in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #3 0x00007fc83065947b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #4 0x0000000000523e86 in SCHSSearch (mpm_ctx=0x7fc699966b30, mpm_thread_ctx=0x7fc4db882828, pmq=0x7fc4db882858, buf=0x7fbf656876a0 , buflen=1180) at util-mpm-hs.c:946 #5 0x00000000005a23e8 in PrefilterPktPayload (det_ctx=0x7fc4db882740, p=0x7fc4e64ff660, pectx=0x7fc699966b30) at detect-engine-payload.c:122 #6 0x00000000005a5b4c in Prefilter (det_ctx=0x7fc4db882740, sgh=0x7fc699674880, p=0x7fc4e64ff660, flags=4 '\004') at detect-engine-prefilter.c:182 #7 0x00000000006f2620 in DetectRunPrefilterPkt (tv=0x7fc6aa071a50, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc4db882740, p=0x7fc4e64ff660, scratch=0x7fc4f3ffe6f0) at detect.c:686 #8 0x00000000006f1d01 in DetectRun (th_v=0x7fc6aa071a50, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc4db882740, p=0x7fc4e64ff660) at detect.c:132 #9 0x00000000006f19ff in DetectFlow (tv=0x7fc6aa071a50, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc4db882740, p=0x7fc4e64ff660) at detect.c:1681 #10 0x00000000006f18a8 in Detect (tv=0x7fc6aa071a50, p=0x7fc4e64ff660, data=0x7fc4db882740) at detect.c:1753 #11 0x0000000000611758 in FlowWorker (tv=0x7fc6aa071a50, p=0x7fc4e64ff660, data=0x7fc4e653b0f0) at flow-worker.c:552 #12 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6aa071a50, p=0x7fc4e64ff660, slot=0x7fc6b4cd3680) at tm-threads.c:117 #13 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6aa071a50, s=0x7fc6b4cd3680, p=0x7fc4e64ff660) at ./tm-threads.h:195 #14 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc4ebfff680, pbd=0x7fbf65600000, ppd=0x7fbf65687620) at source-af-packet.c:983 #15 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc4ebfff680, pbd=0x7fbf65600000) at source-af-packet.c:996 #16 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc4ebfff680) at source-af-packet.c:1043 #17 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6aa071a50, data=0x7fc4ebfff680, slot=0x7fc6aecb2040) at source-af-packet.c:1393 #18 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6aa071a50) at tm-threads.c:312 #19 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #20 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 2 (Thread 0x7fc2924e7700 (LWP 58680)): #0 0x00000000006f4307 in DetectPrefilterMergeSort (de_ctx=0x7fc6bce66f30, det_ctx=0x7fc25b882740) at detect.c:351 #1 0x00000000006f264f in DetectRunPrefilterPkt (tv=0x7fc6ba64b240, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc25b882740, p=0x7fc2664ff660, scratch=0x7fc2924e66f0) at detect.c:695 #2 0x00000000006f1d01 in DetectRun (th_v=0x7fc6ba64b240, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc25b882740, p=0x7fc2664ff660) at detect.c:132 #3 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba64b240, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc25b882740, p=0x7fc2664ff660) at detect.c:1681 #4 0x00000000006f18a8 in Detect (tv=0x7fc6ba64b240, p=0x7fc2664ff660, data=0x7fc25b882740) at detect.c:1753 #5 0x0000000000611758 in FlowWorker (tv=0x7fc6ba64b240, p=0x7fc2664ff660, data=0x7fc26653b0f0) at flow-worker.c:552 #6 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba64b240, p=0x7fc2664ff660, slot=0x7fc6b49b9870) at tm-threads.c:117 #7 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba64b240, s=0x7fc6b49b9870, p=0x7fc2664ff660) at ./tm-threads.h:195 #8 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc26ffff680, pbd=0x7fbb25200000, ppd=0x7fbb25312c40) at source-af-packet.c:983 #9 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc26ffff680, pbd=0x7fbb25200000) at source-af-packet.c:996 #10 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc26ffff680) at source-af-packet.c:1043 #11 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba64b240, data=0x7fc26ffff680, slot=0x7fc6ae2348d0) at source-af-packet.c:1393 #12 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba64b240) at tm-threads.c:312 #13 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 1 (Thread 0x7fc49fa74700 (LWP 58647)): #0 0x000000000054b9a5 in HttpRangeClose (c=0x7fb10797f120, flags=0) at app-layer-htp-range.c:530 #1 0x00000000005488a2 in HTPFileCloseHandleRange (files=0x7fb3cfaffec0, flags=0, c=0x7fb10797f120, data=0x0, data_len=0) at app-layer-htp-file.c:360 #2 0x0000000000548a20 in HTPFileClose (s=0x7fb1f884a290, data=0x0, data_len=0, flags=0 '\000', direction=8 '\b') at app-layer-htp-file.c:418 #3 0x000000000054473e in HTPCallbackResponseComplete (tx=0x7fb1fa34d360) at app-layer-htp.c:2255 #4 0x00007fc830bdeb61 in htp_hook_run_all (hook=0x1c5b340, user_data=0x7fb1fa34d360) at htp_hooks.c:127 #5 0x00007fc830be711b in htp_tx_state_response_complete_ex (tx=0x7fb1fa34d360, hybrid_mode=0) at htp_transaction.c:1219 #6 0x00007fc830be493a in htp_connp_res_data (connp=0x7faea5759050, timestamp=, data=, len=) at htp_response.c:1321 #7 0x0000000000543281 in HTPHandleResponseData (f=0x7fb483265450, htp_state=0x7fb1f884a290, pstate=0x7fb2a31837a0, stream_slice=..., local_data=0x0) at app-layer-htp.c:942 #8 0x000000000054f1fe in AppLayerParserParse (tv=0x7fc6baa60690, alp_tctx=0x7fc49259db30, f=0x7fb483265450, alproto=1, flags=26 '\032', input=0x0, input_len=6516) at app-layer-parser.c:1304 #9 0x000000000053506c in AppLayerHandleTCPData (tv=0x7fc6baa60690, ra_ctx=0x7fc492573c30, p=0x7fc4924fec10, f=0x7fb483265450, ssn=0x7fb5a6e02500, stream=0x7fc49fa734f0, data=0x0, data_len=6516, flags=26 '\032') at app-layer.c:633 #10 0x000000000067b54f in ReassembleUpdateAppLayer (tv=0x7fc6baa60690, ra_ctx=0x7fc492573c30, ssn=0x7fb5a6e02500, stream=0x7fc49fa734f0, p=0x7fc4924fec10, dir=UPDATE_DIR_PACKET) at stream-tcp-reassemble.c:1133 #11 0x000000000067b240 in StreamTcpReassembleAppLayer (tv=0x7fc6baa60690, ra_ctx=0x7fc492573c30, ssn=0x7fb5a6e02500, stream=0x7fb5a6e02510, p=0x7fc4924fec10, dir=UPDATE_DIR_PACKET) at stream-tcp-reassemble.c:1264 #12 0x000000000067cf60 in StreamTcpReassembleHandleSegment (tv=0x7fc6baa60690, ra_ctx=0x7fc492573c30, ssn=0x7fb5a6e02500, stream=0x7fb5a6e02510, p=0x7fc4924fec10, pq=0x7fc49253b120) at stream-tcp-reassemble.c:1930 #13 0x00000000006617d2 in StreamTcpPacket (tv=0x7fc6baa60690, p=0x7fc4924fec10, stt=0x7fc497fffc70, pq=0x7fc49253b120) at stream-tcp.c:4936 #14 0x0000000000664136 in StreamTcp (tv=0x7fc6baa60690, p=0x7fc4924fec10, data=0x7fc497fffc70, pq=0x7fc49253b120) at stream-tcp.c:5312 #15 0x0000000000611bb3 in FlowWorkerStreamTCPUpdate (tv=0x7fc6baa60690, fw=0x7fc49253b0f0, p=0x7fc4924fec10, detect_thread=0x7fc487882740, timeout=true) at flow-worker.c:370 #16 0x0000000000612438 in FlowWorkerFlowTimeout (tv=0x7fc6baa60690, p=0x7fc4924fec10, fw=0x7fc49253b0f0, detect_thread=0x7fc487882740) at flow-worker.c:413 #17 0x00000000006123d8 in FlowFinish (tv=0x7fc6baa60690, f=0x7fb483265450, fw=0x7fc49253b0f0, detect_thread=0x7fc487882740) at flow-worker.c:157 #18 0x000000000061208c in CheckWorkQueue (tv=0x7fc6baa60690, fw=0x7fc49253b0f0, detect_thread=0x7fc487882740, counters=0x7fc49fa73768, fq=0x7fc49fa73790) at flow-worker.c:177 #19 0x0000000000611ed9 in FlowWorkerProcessInjectedFlows (tv=0x7fc6baa60690, fw=0x7fc49253b0f0, p=0x7fc4924ff660, detect_thread=0x7fc487882740) at flow-worker.c:460 #20 0x000000000061189b in FlowWorker (tv=0x7fc6baa60690, p=0x7fc4924ff660, data=0x7fc49253b0f0) at flow-worker.c:590 #21 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6baa60690, p=0x7fc4924ff660, slot=0x7fc6b9f3f660) at tm-threads.c:117 #22 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6baa60690, s=0x7fc6b9f3f660, p=0x7fc4924ff660) at ./tm-threads.h:195 #23 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc497fff680, pbd=0x7fbed7200000, ppd=0x7fbed7288fd8) at source-af-packet.c:983 #24 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc497fff680, pbd=0x7fbed7200000) at source-af-packet.c:996 #25 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc497fff680) at source-af-packet.c:1043 #26 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6baa60690, data=0x7fc497fff680, slot=0x7fc6b7a20370) at source-af-packet.c:1393 #27 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6baa60690) at tm-threads.c:312 #28 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #29 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95