Thread 72 (Thread 0x7fc23f7fe700 (LWP 58684)): #0 0x00000000006603d6 in StreamTcpSessionClear (ssnptr=0x7fb50418f170) at stream-tcp.c:259 #1 0x000000000060798e in FlowClearMemory (f=0x7fc6d94a2170, proto_map=0 '\000') at flow.c:1077 #2 0x000000000060d551 in Recycler (tv=0x7fc6ba47fec0, output_thread_data=0x7fc228000b80, f=0x7fc6d94a2170) at flow-manager.c:590 #3 0x000000000060c3ca in FlowRecycler (th_v=0x7fc6ba47fec0, thread_data=0x7fc228000b60) at flow-manager.c:1142 #4 0x00000000005071e6 in TmThreadsManagement (td=0x7fc6ba47fec0) at tm-threads.c:552 #5 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #6 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 71 (Thread 0x7fc58975b700 (LWP 58636)): #0 DetectRulePacketRules (tv=0x7fc69dab0fa0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc543882740, p=0x7fc54e4ff660, pflow=0x7fc6bde4d000, scratch=0x7fc58975a6f0) at detect.c:774 #1 0x00000000006f1d1e in DetectRun (th_v=0x7fc69dab0fa0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc543882740, p=0x7fc54e4ff660) at detect.c:136 #2 0x00000000006f19ff in DetectFlow (tv=0x7fc69dab0fa0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc543882740, p=0x7fc54e4ff660) at detect.c:1681 #3 0x00000000006f18a8 in Detect (tv=0x7fc69dab0fa0, p=0x7fc54e4ff660, data=0x7fc543882740) at detect.c:1753 #4 0x0000000000611758 in FlowWorker (tv=0x7fc69dab0fa0, p=0x7fc54e4ff660, data=0x7fc54e53b0f0) at flow-worker.c:552 #5 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc69dab0fa0, p=0x7fc54e4ff660, slot=0x7fc6a3640760) at tm-threads.c:117 #6 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc69dab0fa0, s=0x7fc6a3640760, p=0x7fc54e4ff660) at ./tm-threads.h:195 #7 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc557fff680, pbd=0x7fc004000000, ppd=0x7fc004090ed0) at source-af-packet.c:983 #8 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc557fff680, pbd=0x7fc004000000) at source-af-packet.c:996 #9 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc557fff680) at source-af-packet.c:1043 #10 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc69dab0fa0, data=0x7fc557fff680, slot=0x7fc6b78c6270) at source-af-packet.c:1393 #11 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc69dab0fa0) at tm-threads.c:312 #12 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #13 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 70 (Thread 0x7fc2d7a74700 (LWP 58674)): #0 __GI___libc_free (mem=0x7fb372f76cd0) at malloc.c:3093 #1 0x0000000000556913 in SSLStateFree (p=0x7fb372f76cd0) at app-layer-ssl.c:2742 #2 0x000000000054fd8b in AppLayerParserStateProtoCleanup (protomap=0 '\000', alproto=4, alstate=0x7fb372f76cd0, pstate=0x7fb9e0173780) at app-layer-parser.c:1543 #3 0x000000000054fdf1 in AppLayerParserStateCleanup (f=0x7fc6d5dd6820, alstate=0x7fb372f76cd0, pstate=0x7fb9e0173780) at app-layer-parser.c:1554 #4 0x00000000006049ec in FlowCleanupAppLayer (f=0x7fc6d5dd6820) at flow.c:147 #5 0x00000000006079a0 in FlowClearMemory (f=0x7fc6d5dd6820, proto_map=0 '\000') at flow.c:1082 #6 0x0000000000612119 in CheckWorkQueue (tv=0x7fc6ba5d9640, fw=0x7fc2ca53b0f0, detect_thread=0x7fc2bf882740, counters=0x7fc2d7a73768, fq=0x7fc2d7a73790) at flow-worker.c:192 #7 0x0000000000611ed9 in FlowWorkerProcessInjectedFlows (tv=0x7fc6ba5d9640, fw=0x7fc2ca53b0f0, p=0x7fc2ca4ff660, detect_thread=0x7fc2bf882740) at flow-worker.c:460 #8 0x000000000061189b in FlowWorker (tv=0x7fc6ba5d9640, p=0x7fc2ca4ff660, data=0x7fc2ca53b0f0) at flow-worker.c:590 #9 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba5d9640, p=0x7fc2ca4ff660, slot=0x7fc69ff950c0) at tm-threads.c:117 #10 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba5d9640, s=0x7fc69ff950c0, p=0x7fc2ca4ff660) at ./tm-threads.h:195 #11 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc2cffff680, pbd=0x7fbbd5200000, ppd=0x7fbbd52cc960) at source-af-packet.c:983 #12 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc2cffff680, pbd=0x7fbbd5200000) at source-af-packet.c:996 #13 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc2cffff680) at source-af-packet.c:1043 #14 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba5d9640, data=0x7fc2cffff680, slot=0x7fc6b81b2a20) at source-af-packet.c:1393 #15 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba5d9640) at tm-threads.c:312 #16 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #17 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 69 (Thread 0x7fc23ffff700 (LWP 58683)): #0 0x000000000060c5b7 in RemoveFromHash (f=0x7fb534ab6270, prev_f=0x0) at ./flow-hash.h:90 #1 0x000000000060cecd in FlowManagerHashRowTimeout (td=0x7fc238000b90, f=0x7fb534ab6270, ts=0x7fc23fffeab0, emergency=0, counters=0x7fc23fffe9f0, next_ts=0x7fc23fffe894) at flow-manager.c:367 #2 0x000000000060cb8a in FlowTimeoutHash (td=0x7fc238000b90, ts=0x7fc23fffeab0, hash_min=5133289, hash_max=5149955, counters=0x7fc23fffe9f0) at flow-manager.c:451 #3 0x000000000060cd7c in FlowTimeoutHashInChunks (td=0x7fc238000b90, ts=0x7fc23fffeab0, hash_min=4000001, hash_max=8000000, counters=0x7fc23fffe9f0, iter=68, chunks=240) at flow-manager.c:504 #4 0x000000000060bb76 in FlowManager (th_v=0x7fc6ba429030, thread_data=0x7fc238000b60) at flow-manager.c:853 #5 0x00000000005071e6 in TmThreadsManagement (td=0x7fc6ba429030) at tm-threads.c:552 #6 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #7 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 68 (Thread 0x7fc29175b700 (LWP 58681)): #0 0x00000000006f2735 in DetectRulePacketRules (tv=0x7fc6ba6651c0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc24b882740, p=0x7fc2564ff660, pflow=0x7fb9201e3c00, scratch=0x7fc29175a6f0) at detect.c:754 #1 0x00000000006f1d1e in DetectRun (th_v=0x7fc6ba6651c0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc24b882740, p=0x7fc2564ff660) at detect.c:136 #2 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba6651c0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc24b882740, p=0x7fc2564ff660) at detect.c:1681 #3 0x00000000006f18a8 in Detect (tv=0x7fc6ba6651c0, p=0x7fc2564ff660, data=0x7fc24b882740) at detect.c:1753 #4 0x0000000000611758 in FlowWorker (tv=0x7fc6ba6651c0, p=0x7fc2564ff660, data=0x7fc25653b0f0) at flow-worker.c:552 #5 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba6651c0, p=0x7fc2564ff660, slot=0x7fc6b341dd90) at tm-threads.c:117 #6 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba6651c0, s=0x7fc6b341dd90, p=0x7fc2564ff660) at ./tm-threads.h:195 #7 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc25ffff680, pbd=0x7fbaffa00000, ppd=0x7fbaffa432b8) at source-af-packet.c:983 #8 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc25ffff680, pbd=0x7fbaffa00000) at source-af-packet.c:996 #9 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc25ffff680) at source-af-packet.c:1043 #10 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba6651c0, data=0x7fc25ffff680, slot=0x7fc6bbfece90) at source-af-packet.c:1393 #11 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba6651c0) at tm-threads.c:312 #12 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #13 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 67 (Thread 0x7fc36fa74700 (LWP 58665)): #0 DetectRulePacketRules (tv=0x7fc6ba767c70, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc357882740, p=0x7fc3624ff660, pflow=0x7fc6bd17f430, scratch=0x7fc36fa736f0) at detect.c:756 #1 0x00000000006f1d1e in DetectRun (th_v=0x7fc6ba767c70, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc357882740, p=0x7fc3624ff660) at detect.c:136 #2 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba767c70, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc357882740, p=0x7fc3624ff660) at detect.c:1681 #3 0x00000000006f18a8 in Detect (tv=0x7fc6ba767c70, p=0x7fc3624ff660, data=0x7fc357882740) at detect.c:1753 #4 0x0000000000611758 in FlowWorker (tv=0x7fc6ba767c70, p=0x7fc3624ff660, data=0x7fc36253b0f0) at flow-worker.c:552 #5 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba767c70, p=0x7fc3624ff660, slot=0x7fc6b3f53740) at tm-threads.c:117 #6 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba767c70, s=0x7fc6b3f53740, p=0x7fc3624ff660) at ./tm-threads.h:195 #7 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc367fff680, pbd=0x7fbccca00000, ppd=0x7fbcccab32f8) at source-af-packet.c:983 #8 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc367fff680, pbd=0x7fbccca00000) at source-af-packet.c:996 #9 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc367fff680) at source-af-packet.c:1043 #10 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba767c70, data=0x7fc367fff680, slot=0x7fc6b3f56170) at source-af-packet.c:1393 #11 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba767c70) at tm-threads.c:312 #12 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #13 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 66 (Thread 0x7fc23d7fa700 (LWP 58688)): #0 0x00007fc82fde212b in __GI___select (nfds=7, readfds=0x7fc23d7f99e8, writefds=0x0, exceptfds=0x0, timeout=0x7fc23d7f9a70) at ../sysdeps/unix/sysv/linux/select.c:41 #1 0x0000000000509642 in UnixMain (this=0xd2c8d0 ) at unix-manager.c:650 #2 0x000000000050925c in UnixManager (th_v=0x7fc6aef4fb80, thread_data=0x7fc224000b60) at unix-manager.c:1125 #3 0x00000000005071e6 in TmThreadsManagement (td=0x7fc6aef4fb80) at tm-threads.c:552 #4 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #5 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 65 (Thread 0x7fc5cfa74700 (LWP 58629)): #0 0x0000000000571d99 in DecodeTCPOptions (p=0x7fc5c24ff660, pkt=0x7fc0df434700 , pktlen=20) at decode-tcp.c:64 #1 0x0000000000571c8e in DecodeTCPPacket (tv=0x7fc6bba1b7c0, p=0x7fc5c24ff660, pkt=0x7fc0df4346dc , len=40) at decode-tcp.c:237 #2 0x0000000000571993 in DecodeTCP (tv=0x7fc6bba1b7c0, dtv=0x7fc5c7fffcc0, p=0x7fc5c24ff660, pkt=0x7fc0df4346dc , len=40) at decode-tcp.c:256 #3 0x000000000056ad6d in DecodeIPV4 (tv=0x7fc6bba1b7c0, dtv=0x7fc5c7fffcc0, p=0x7fc5c24ff660, pkt=0x7fc0df4346c8 , len=75) at decode-ipv4.c:562 #4 0x00000000005739dc in DecodeNetworkLayer (tv=0x7fc6bba1b7c0, dtv=0x7fc5c7fffcc0, proto=2048, p=0x7fc5c24ff660, data=0x7fc0df4346c8 , len=75) at ./decode.h:1299 #5 0x0000000000573713 in DecodeVLAN (tv=0x7fc6bba1b7c0, dtv=0x7fc5c7fffcc0, p=0x7fc5c24ff660, pkt=0x7fc0df4346c4 , len=79) at decode-vlan.c:94 #6 0x000000000056a1c1 in DecodeNetworkLayer (tv=0x7fc6bba1b7c0, dtv=0x7fc5c7fffcc0, proto=33024, p=0x7fc5c24ff660, data=0x7fc0df4346c4 , len=79) at ./decode.h:1319 #7 0x0000000000569e6f in DecodeEthernet (tv=0x7fc6bba1b7c0, dtv=0x7fc5c7fffcc0, p=0x7fc5c24ff660, pkt=0x7fc0df4346b6 , len=93) at decode-ethernet.c:61 #8 0x0000000000659463 in DecodeLinkLayer (tv=0x7fc6bba1b7c0, dtv=0x7fc5c7fffcc0, datalink=1, p=0x7fc5c24ff660, data=0x7fc0df4346b6 , len=93) at ./decode.h:1266 #9 0x00000000006540a3 in DecodeAFP (tv=0x7fc6bba1b7c0, p=0x7fc5c24ff660, data=0x7fc5c7fffcc0) at source-af-packet.c:2710 #10 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6bba1b7c0, p=0x7fc5c24ff660, slot=0x7fc69f467850) at tm-threads.c:117 #11 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6bba1b7c0, s=0x7fc69f467850, p=0x7fc5c24ff660) at ./tm-threads.h:195 #12 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc5c7fff680, pbd=0x7fc0df400000, ppd=0x7fc0df434660) at source-af-packet.c:983 #13 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc5c7fff680, pbd=0x7fc0df400000) at source-af-packet.c:996 #14 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc5c7fff680) at source-af-packet.c:1043 #15 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6bba1b7c0, data=0x7fc5c7fff680, slot=0x7fc6a6911b60) at source-af-packet.c:1393 #16 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6bba1b7c0) at tm-threads.c:312 #17 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #18 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 64 (Thread 0x7fc23e7fc700 (LWP 58686)): #0 futex_abstimed_wait_cancelable (private=, abstime=0x7fc23e7fbb18, clockid=, expected=0, futex_word=0x7fc6992ac278) at ../sysdeps/nptl/futex-internal.h:320 #1 __pthread_cond_wait_common (abstime=0x7fc23e7fbb18, clockid=, mutex=0x7fc699238a80, cond=0x7fc6992ac250) at pthread_cond_wait.c:520 #2 __pthread_cond_timedwait (cond=0x7fc6992ac250, mutex=0x7fc699238a80, abstime=0x7fc23e7fbb18) at pthread_cond_wait.c:656 #3 0x000000000056112c in StatsWakeupThread (arg=0x7fc6ba4dd4f0) at counters.c:487 #4 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #5 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 63 (Thread 0x7fc2d5f5c700 (LWP 58676)): #0 0x000000000058d5c2 in DetectEnginePktInspectionRun (tv=0x7fc6bc3baa40, det_ctx=0x7fc29f882740, s=0x7fc6bcef5050, f=0x7fb1d4314f90, p=0x7fc2aa4ff660, alert_flags=0x7fc2d5f5b677 "") at detect-engine.c:1814 #1 0x00000000006f28b6 in DetectRulePacketRules (tv=0x7fc6bc3baa40, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc29f882740, p=0x7fc2aa4ff660, pflow=0x7fb1d4314f90, scratch=0x7fc2d5f5b6f0) at detect.c:796 #2 0x00000000006f1d1e in DetectRun (th_v=0x7fc6bc3baa40, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc29f882740, p=0x7fc2aa4ff660) at detect.c:136 #3 0x00000000006f19ff in DetectFlow (tv=0x7fc6bc3baa40, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc29f882740, p=0x7fc2aa4ff660) at detect.c:1681 #4 0x00000000006f18a8 in Detect (tv=0x7fc6bc3baa40, p=0x7fc2aa4ff660, data=0x7fc29f882740) at detect.c:1753 #5 0x0000000000611758 in FlowWorker (tv=0x7fc6bc3baa40, p=0x7fc2aa4ff660, data=0x7fc2aa53b0f0) at flow-worker.c:552 #6 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6bc3baa40, p=0x7fc2aa4ff660, slot=0x7fc6b81863b0) at tm-threads.c:117 #7 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6bc3baa40, s=0x7fc6b81863b0, p=0x7fc2aa4ff660) at ./tm-threads.h:195 #8 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc2b3fff680, pbd=0x7fbb92800000, ppd=0x7fbb92814968) at source-af-packet.c:983 #9 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc2b3fff680, pbd=0x7fbb92800000) at source-af-packet.c:996 #10 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc2b3fff680) at source-af-packet.c:1043 #11 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6bc3baa40, data=0x7fc2b3fff680, slot=0x7fc6a39af930) at source-af-packet.c:1393 #12 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6bc3baa40) at tm-threads.c:312 #13 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 62 (Thread 0x7fc32bfff700 (LWP 58669)): #0 0x00007fc82fd62bd2 in malloc_consolidate (av=av@entry=0x7fc320000020) at malloc.c:4486 #1 0x00007fc82fd64e03 in _int_malloc (av=av@entry=0x7fc320000020, bytes=bytes@entry=4096) at malloc.c:3699 #2 0x00007fc82fd67419 in __GI___libc_malloc (bytes=4096) at malloc.c:3066 #3 0x000000000088ae94 in alloc::alloc::alloc (layout=...) at /build/rustc-Nbf2Kl/rustc-1.53.0+dfsg1+llvm/library/alloc/src/alloc.rs:86 #4 alloc::alloc::Global::alloc_impl (self=, layout=..., zeroed=false) at /build/rustc-Nbf2Kl/rustc-1.53.0+dfsg1+llvm/library/alloc/src/alloc.rs:166 #5 ::allocate (self=, layout=...) at /build/rustc-Nbf2Kl/rustc-1.53.0+dfsg1+llvm/library/alloc/src/alloc.rs:226 #6 alloc::raw_vec::RawVec::allocate_in (capacity=4096, init=alloc::raw_vec::AllocInit::Uninitialized, alloc=...) at /build/rustc-Nbf2Kl/rustc-1.53.0+dfsg1+llvm/library/alloc/src/raw_vec.rs:195 #7 alloc::raw_vec::RawVec::with_capacity_in (capacity=4096, alloc=...) at /build/rustc-Nbf2Kl/rustc-1.53.0+dfsg1+llvm/library/alloc/src/raw_vec.rs:136 #8 alloc::vec::Vec::with_capacity_in (capacity=4096, alloc=...) at /build/rustc-Nbf2Kl/rustc-1.53.0+dfsg1+llvm/library/alloc/src/vec/mod.rs:580 #9 alloc::vec::Vec::with_capacity (capacity=4096) at /build/rustc-Nbf2Kl/rustc-1.53.0+dfsg1+llvm/library/alloc/src/vec/mod.rs:442 #10 alloc::string::String::with_capacity (capacity=4096) at /build/rustc-Nbf2Kl/rustc-1.53.0+dfsg1+llvm/library/alloc/src/string.rs:411 #11 suricata::jsonbuilder::JsonBuilder::new_object_with_capacity (capacity=4096) at src/jsonbuilder.rs:106 #12 suricata::jsonbuilder::JsonBuilder::new_object () at src/jsonbuilder.rs:102 #13 suricata::jsonbuilder::jb_new_object () at src/jsonbuilder.rs:622 #14 0x0000000000623cef in CreateEveHeader (p=0x7fc31e4fec10, dir=LOG_DIR_FLOW, event_type=0xb199ed "tls", addr=0x0, eve_ctx=0x7fc6bce13010) at output-json.c:840 #15 0x0000000000640429 in JsonTlsLogger (tv=0x7fc6bcbecad0, thread_data=0x7fc313dae280, p=0x7fc31e4fec10, f=0x7fb1e4d7be30, state=0x7fb239364700, txptr=0x7fb239364700, tx_id=0) at output-json-tls.c:404 #16 0x0000000000645e9b in OutputTxLog (tv=0x7fc6bcbecad0, p=0x7fc31e4fec10, thread_data=0x7fc313d6df80) at output-tx.c:296 #17 0x00000000006194f5 in OutputLoggerLog (tv=0x7fc6bcbecad0, p=0x7fc31e4fec10, thread_data=0x7fc313d4d600) at output.c:885 #18 0x0000000000612482 in FlowWorkerFlowTimeout (tv=0x7fc6bcbecad0, p=0x7fc31e4fec10, fw=0x7fc31e53b0f0, detect_thread=0x7fc313882740) at flow-worker.c:426 #19 0x00000000006123d8 in FlowFinish (tv=0x7fc6bcbecad0, f=0x7fb1e4d7be30, fw=0x7fc31e53b0f0, detect_thread=0x7fc313882740) at flow-worker.c:157 #20 0x000000000061208c in CheckWorkQueue (tv=0x7fc6bcbecad0, fw=0x7fc31e53b0f0, detect_thread=0x7fc313882740, counters=0x7fc32bffe768, fq=0x7fc32bffe790) at flow-worker.c:177 #21 0x0000000000611ed9 in FlowWorkerProcessInjectedFlows (tv=0x7fc6bcbecad0, fw=0x7fc31e53b0f0, p=0x7fc31e4ff660, detect_thread=0x7fc313882740) at flow-worker.c:460 #22 0x000000000061189b in FlowWorker (tv=0x7fc6bcbecad0, p=0x7fc31e4ff660, data=0x7fc31e53b0f0) at flow-worker.c:590 #23 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6bcbecad0, p=0x7fc31e4ff660, slot=0x7fc69eebb170) at tm-threads.c:117 #24 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6bcbecad0, s=0x7fc69eebb170, p=0x7fc31e4ff660) at ./tm-threads.h:195 #25 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc323fff680, pbd=0x7fbc49a00000, ppd=0x7fbc49b20f38) at source-af-packet.c:983 #26 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc323fff680, pbd=0x7fbc49a00000) at source-af-packet.c:996 #27 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc323fff680) at source-af-packet.c:1043 #28 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6bcbecad0, data=0x7fc323fff680, slot=0x7fc69f813930) at source-af-packet.c:1393 #29 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6bcbecad0) at tm-threads.c:312 #30 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #31 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 61 (Thread 0x7fc536ce8700 (LWP 58639)): #0 0x00007fc83066816b in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007fc83066ac25 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x00007fc83075552a in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #3 0x00007fc83065947b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #4 0x0000000000523e86 in SCHSSearch (mpm_ctx=0x7fc6997cd8f0, mpm_thread_ctx=0x7fc50f882828, pmq=0x7fc50f882858, buf=0x7fbfb2a0aac8 , buflen=1366) at util-mpm-hs.c:946 #5 0x00000000005a23e8 in PrefilterPktPayload (det_ctx=0x7fc50f882740, p=0x7fc51a4ff660, pectx=0x7fc6997cd8f0) at detect-engine-payload.c:122 #6 0x00000000005a5b4c in Prefilter (det_ctx=0x7fc50f882740, sgh=0x7fc6991f2b30, p=0x7fc51a4ff660, flags=8 '\b') at detect-engine-prefilter.c:182 #7 0x00000000006f2620 in DetectRunPrefilterPkt (tv=0x7fc6b20c90c0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc50f882740, p=0x7fc51a4ff660, scratch=0x7fc536ce76f0) at detect.c:686 #8 0x00000000006f1d01 in DetectRun (th_v=0x7fc6b20c90c0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc50f882740, p=0x7fc51a4ff660) at detect.c:132 #9 0x00000000006f19ff in DetectFlow (tv=0x7fc6b20c90c0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc50f882740, p=0x7fc51a4ff660) at detect.c:1681 #10 0x00000000006f18a8 in Detect (tv=0x7fc6b20c90c0, p=0x7fc51a4ff660, data=0x7fc50f882740) at detect.c:1753 #11 0x0000000000611758 in FlowWorker (tv=0x7fc6b20c90c0, p=0x7fc51a4ff660, data=0x7fc51a53b0f0) at flow-worker.c:552 #12 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6b20c90c0, p=0x7fc51a4ff660, slot=0x7fc69bac1cb0) at tm-threads.c:117 #13 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6b20c90c0, s=0x7fc69bac1cb0, p=0x7fc51a4ff660) at ./tm-threads.h:195 #14 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc523fff680, pbd=0x7fbfb2a00000, ppd=0x7fbfb2a0aa38) at source-af-packet.c:983 #15 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc523fff680, pbd=0x7fbfb2a00000) at source-af-packet.c:996 #16 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc523fff680) at source-af-packet.c:1043 #17 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6b20c90c0, data=0x7fc523fff680, slot=0x7fc6b9d5b770) at source-af-packet.c:1393 #18 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6b20c90c0) at tm-threads.c:312 #19 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #20 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 60 (Thread 0x7fc23dffb700 (LWP 58687)): #0 futex_abstimed_wait_cancelable (private=, abstime=0x7fc23dffab08, clockid=, expected=0, futex_word=0x7fc6991d83f8) at ../sysdeps/nptl/futex-internal.h:320 #1 __pthread_cond_wait_common (abstime=0x7fc23dffab08, clockid=, mutex=0x7fc690df8550, cond=0x7fc6991d83d0) at pthread_cond_wait.c:520 #2 __pthread_cond_timedwait (cond=0x7fc6991d83d0, mutex=0x7fc690df8550, abstime=0x7fc23dffab08) at pthread_cond_wait.c:656 #3 0x00000000005615a6 in StatsMgmtThread (arg=0x7fc69f760d90) at counters.c:415 #4 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #5 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 59 (Thread 0x7fc23effd700 (LWP 58685)): #0 0x00007fc82fdaa3bf in __GI___clock_nanosleep (clock_id=clock_id@entry=0, flags=flags@entry=0, req=req@entry=0x7fc23effca00, rem=rem@entry=0x0) at ../sysdeps/unix/sysv/linux/clock_nanosleep.c:78 #1 0x00007fc82fdb0047 in __GI___nanosleep (requested_time=requested_time@entry=0x7fc23effca00, remaining=remaining@entry=0x0) at nanosleep.c:27 #2 0x00007fc82fde29bf in usleep (useconds=) at ../sysdeps/posix/usleep.c:32 #3 0x000000000060c410 in FlowRecycler (th_v=0x7fc6ba4b88c0, thread_data=0x7fc22c000b60) at flow-manager.c:1167 #4 0x00000000005071e6 in TmThreadsManagement (td=0x7fc6ba4b88c0) at tm-threads.c:552 #5 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #6 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 58 (Thread 0x7fc32b273700 (LWP 58670)): #0 0x000000000058d5c2 in DetectEnginePktInspectionRun (tv=0x7fc6ba7f92c0, det_ctx=0x7fc303882740, s=0x7fc6bcefeb20, f=0x7fc6bd023150, p=0x7fc30e4ff660, alert_flags=0x7fc32b272677 "") at detect-engine.c:1814 #1 0x00000000006f28b6 in DetectRulePacketRules (tv=0x7fc6ba7f92c0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc303882740, p=0x7fc30e4ff660, pflow=0x7fc6bd023150, scratch=0x7fc32b2726f0) at detect.c:796 #2 0x00000000006f1d1e in DetectRun (th_v=0x7fc6ba7f92c0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc303882740, p=0x7fc30e4ff660) at detect.c:136 #3 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba7f92c0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc303882740, p=0x7fc30e4ff660) at detect.c:1681 #4 0x00000000006f18a8 in Detect (tv=0x7fc6ba7f92c0, p=0x7fc30e4ff660, data=0x7fc303882740) at detect.c:1753 #5 0x0000000000611758 in FlowWorker (tv=0x7fc6ba7f92c0, p=0x7fc30e4ff660, data=0x7fc30e53b0f0) at flow-worker.c:552 #6 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba7f92c0, p=0x7fc30e4ff660, slot=0x7fc6b9fe7e30) at tm-threads.c:117 #7 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba7f92c0, s=0x7fc6b9fe7e30, p=0x7fc30e4ff660) at ./tm-threads.h:195 #8 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc317fff680, pbd=0x7fbc39200000, ppd=0x7fbc3935eac8) at source-af-packet.c:983 #9 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc317fff680, pbd=0x7fbc39200000) at source-af-packet.c:996 #10 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc317fff680) at source-af-packet.c:1043 #11 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba7f92c0, data=0x7fc317fff680, slot=0x7fc6ae0bb820) at source-af-packet.c:1393 #12 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba7f92c0) at tm-threads.c:312 #13 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 57 (Thread 0x7fc4589cf700 (LWP 58655)): #0 DetectPrefilterBuildNonPrefilterList (det_ctx=0x7fc403882740, mask=131 '\203', alproto=0 '\000') at detect.c:380 #1 0x00000000006f2603 in DetectRunPrefilterPkt (tv=0x7fc6ba8d4490, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc403882740, p=0x7fc40e4ff660, scratch=0x7fc4589ce6f0) at detect.c:681 #2 0x00000000006f1d01 in DetectRun (th_v=0x7fc6ba8d4490, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc403882740, p=0x7fc40e4ff660) at detect.c:132 #3 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba8d4490, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc403882740, p=0x7fc40e4ff660) at detect.c:1681 #4 0x00000000006f18a8 in Detect (tv=0x7fc6ba8d4490, p=0x7fc40e4ff660, data=0x7fc403882740) at detect.c:1753 #5 0x0000000000611758 in FlowWorker (tv=0x7fc6ba8d4490, p=0x7fc40e4ff660, data=0x7fc40e53b0f0) at flow-worker.c:552 #6 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba8d4490, p=0x7fc40e4ff660, slot=0x7fc6b9e78890) at tm-threads.c:117 #7 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba8d4490, s=0x7fc6b9e78890, p=0x7fc40e4ff660) at ./tm-threads.h:195 #8 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc417fff680, pbd=0x7fbdef000000, ppd=0x7fbdef192808) at source-af-packet.c:983 #9 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc417fff680, pbd=0x7fbdef000000) at source-af-packet.c:996 #10 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc417fff680) at source-af-packet.c:1043 #11 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba8d4490, data=0x7fc417fff680, slot=0x7fc6b7d15ad0) at source-af-packet.c:1393 #12 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba8d4490) at tm-threads.c:312 #13 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 56 (Thread 0x7fc4051d0700 (LWP 58659)): #0 0x00000000006f4463 in SigDsizePrefilter (p=0x7fc3ca4ff660, s=0x7fc6bcf004e0, sflags=1572879) at ./detect-dsize.h:50 #1 0x00000000006f27b6 in DetectRulePacketRules (tv=0x7fc6ba954a80, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc3bf882740, p=0x7fc3ca4ff660, pflow=0x7fb9ac06a7a0, scratch=0x7fc4051cf6f0) at detect.c:774 #2 0x00000000006f1d1e in DetectRun (th_v=0x7fc6ba954a80, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc3bf882740, p=0x7fc3ca4ff660) at detect.c:136 #3 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba954a80, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc3bf882740, p=0x7fc3ca4ff660) at detect.c:1681 #4 0x00000000006f18a8 in Detect (tv=0x7fc6ba954a80, p=0x7fc3ca4ff660, data=0x7fc3bf882740) at detect.c:1753 #5 0x0000000000611758 in FlowWorker (tv=0x7fc6ba954a80, p=0x7fc3ca4ff660, data=0x7fc3ca53b0f0) at flow-worker.c:552 #6 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba954a80, p=0x7fc3ca4ff660, slot=0x7fc6aa8685c0) at tm-threads.c:117 #7 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba954a80, s=0x7fc6aa8685c0, p=0x7fc3ca4ff660) at ./tm-threads.h:195 #8 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc3d3fff680, pbd=0x7fbd6bc00000, ppd=0x7fbd6bc52028) at source-af-packet.c:983 #9 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc3d3fff680, pbd=0x7fbd6bc00000) at source-af-packet.c:996 #10 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc3d3fff680) at source-af-packet.c:1043 #11 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba954a80, data=0x7fc3d3fff680, slot=0x7fc6b9e81cf0) at source-af-packet.c:1393 #12 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba954a80) at tm-threads.c:312 #13 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 55 (Thread 0x7fc2d6ce8700 (LWP 58675)): #0 0x00007fc83071df3c in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007fc8307555a5 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x00007fc83065947b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #3 0x0000000000523e86 in SCHSSearch (mpm_ctx=0x7fc69973ae80, mpm_thread_ctx=0x7fc2af882828, pmq=0x7fc2af882858, buf=0x7fbba00a1458 , buflen=325) at util-mpm-hs.c:946 #4 0x00000000005a23e8 in PrefilterPktPayload (det_ctx=0x7fc2af882740, p=0x7fc2ba4ff660, pectx=0x7fc69973ae80) at detect-engine-payload.c:122 #5 0x00000000005a5b4c in Prefilter (det_ctx=0x7fc2af882740, sgh=0x7fc698f20bf0, p=0x7fc2ba4ff660, flags=8 '\b') at detect-engine-prefilter.c:182 #6 0x00000000006f2620 in DetectRunPrefilterPkt (tv=0x7fc69f9437a0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc2af882740, p=0x7fc2ba4ff660, scratch=0x7fc2d6ce76f0) at detect.c:686 #7 0x00000000006f1d01 in DetectRun (th_v=0x7fc69f9437a0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc2af882740, p=0x7fc2ba4ff660) at detect.c:132 #8 0x00000000006f19ff in DetectFlow (tv=0x7fc69f9437a0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc2af882740, p=0x7fc2ba4ff660) at detect.c:1681 #9 0x00000000006f18a8 in Detect (tv=0x7fc69f9437a0, p=0x7fc2ba4ff660, data=0x7fc2af882740) at detect.c:1753 #10 0x0000000000611758 in FlowWorker (tv=0x7fc69f9437a0, p=0x7fc2ba4ff660, data=0x7fc2ba53b0f0) at flow-worker.c:552 #11 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc69f9437a0, p=0x7fc2ba4ff660, slot=0x7fc6ba21fa90) at tm-threads.c:117 #12 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc69f9437a0, s=0x7fc6ba21fa90, p=0x7fc2ba4ff660) at ./tm-threads.h:195 #13 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc2c3fff680, pbd=0x7fbba0000000, ppd=0x7fbba00a13d8) at source-af-packet.c:983 #14 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc2c3fff680, pbd=0x7fbba0000000) at source-af-packet.c:996 #15 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc2c3fff680) at source-af-packet.c:1043 #16 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc69f9437a0, data=0x7fc2c3fff680, slot=0x7fc6ba21fd10) at source-af-packet.c:1393 #17 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc69f9437a0) at tm-threads.c:312 #18 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #19 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 54 (Thread 0x7fc36ece8700 (LWP 58666)): #0 0x0000000000523e8d in SCHSSearch (mpm_ctx=0x7fc6997bba70, mpm_thread_ctx=0x7fc347882828, pmq=0x7fc347882858, buf=0x7fbca626a398 , buflen=1366) at util-mpm-hs.c:948 #1 0x00000000005a22e6 in PrefilterPktStream (det_ctx=0x7fc347882740, p=0x7fc3524ff660, pectx=0x7fc6997bba70) at detect-engine-payload.c:99 #2 0x00000000005a5b4c in Prefilter (det_ctx=0x7fc347882740, sgh=0x7fc6997c8280, p=0x7fc3524ff660, flags=4 '\004') at detect-engine-prefilter.c:182 #3 0x00000000006f2620 in DetectRunPrefilterPkt (tv=0x7fc6ba771bf0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc347882740, p=0x7fc3524ff660, scratch=0x7fc36ece76f0) at detect.c:686 #4 0x00000000006f1d01 in DetectRun (th_v=0x7fc6ba771bf0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc347882740, p=0x7fc3524ff660) at detect.c:132 #5 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba771bf0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc347882740, p=0x7fc3524ff660) at detect.c:1681 #6 0x00000000006f18a8 in Detect (tv=0x7fc6ba771bf0, p=0x7fc3524ff660, data=0x7fc347882740) at detect.c:1753 #7 0x0000000000611758 in FlowWorker (tv=0x7fc6ba771bf0, p=0x7fc3524ff660, data=0x7fc35253b0f0) at flow-worker.c:552 #8 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba771bf0, p=0x7fc3524ff660, slot=0x7fc6aa817600) at tm-threads.c:117 #9 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba771bf0, s=0x7fc6aa817600, p=0x7fc3524ff660) at ./tm-threads.h:195 #10 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc35bfff680, pbd=0x7fbca6200000, ppd=0x7fbca626a308) at source-af-packet.c:983 #11 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc35bfff680, pbd=0x7fbca6200000) at source-af-packet.c:996 #12 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc35bfff680) at source-af-packet.c:1043 #13 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba771bf0, data=0x7fc35bfff680, slot=0x7fc6aa7fd940) at source-af-packet.c:1393 #14 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba771bf0) at tm-threads.c:312 #15 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #16 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 53 (Thread 0x7fc5cece8700 (LWP 58630)): #0 DetectPrefilterMergeSort (de_ctx=0x7fc6bce66f30, det_ctx=0x7fc5a7882740) at detect.c:356 #1 0x00000000006f264f in DetectRunPrefilterPkt (tv=0x7fc6bba1b630, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc5a7882740, p=0x7fc5b24ff660, scratch=0x7fc5cece76f0) at detect.c:695 #2 0x00000000006f1d01 in DetectRun (th_v=0x7fc6bba1b630, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc5a7882740, p=0x7fc5b24ff660) at detect.c:132 #3 0x00000000006f19ff in DetectFlow (tv=0x7fc6bba1b630, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc5a7882740, p=0x7fc5b24ff660) at detect.c:1681 #4 0x00000000006f18a8 in Detect (tv=0x7fc6bba1b630, p=0x7fc5b24ff660, data=0x7fc5a7882740) at detect.c:1753 #5 0x0000000000611758 in FlowWorker (tv=0x7fc6bba1b630, p=0x7fc5b24ff660, data=0x7fc5b253b0f0) at flow-worker.c:552 #6 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6bba1b630, p=0x7fc5b24ff660, slot=0x7fc6aeb97a60) at tm-threads.c:117 #7 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6bba1b630, s=0x7fc6aeb97a60, p=0x7fc5b24ff660) at ./tm-threads.h:195 #8 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc5bbfff680, pbd=0x7fc0b0200000, ppd=0x7fc0b029ee30) at source-af-packet.c:983 #9 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc5bbfff680, pbd=0x7fc0b0200000) at source-af-packet.c:996 #10 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc5bbfff680) at source-af-packet.c:1043 #11 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6bba1b630, data=0x7fc5bbfff680, slot=0x7fc6b5b281c0) at source-af-packet.c:1393 #12 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6bba1b630) at tm-threads.c:312 #13 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 52 (Thread 0x7fc4f24e7700 (LWP 58644)): #0 0x00000000006f3f16 in DetectPrefilterBuildNonPrefilterList (det_ctx=0x7fc4bb882740, mask=131 '\203', alproto=1 '\001') at detect.c:378 #1 0x00000000006f2603 in DetectRunPrefilterPkt (tv=0x7fc6b67cf030, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc4bb882740, p=0x7fc4c64ff660, scratch=0x7fc4f24e66f0) at detect.c:681 #2 0x00000000006f1d01 in DetectRun (th_v=0x7fc6b67cf030, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc4bb882740, p=0x7fc4c64ff660) at detect.c:132 #3 0x00000000006f19ff in DetectFlow (tv=0x7fc6b67cf030, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc4bb882740, p=0x7fc4c64ff660) at detect.c:1681 #4 0x00000000006f18a8 in Detect (tv=0x7fc6b67cf030, p=0x7fc4c64ff660, data=0x7fc4bb882740) at detect.c:1753 #5 0x0000000000611758 in FlowWorker (tv=0x7fc6b67cf030, p=0x7fc4c64ff660, data=0x7fc4c653b0f0) at flow-worker.c:552 #6 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6b67cf030, p=0x7fc4c64ff660, slot=0x7fc6b9cedd30) at tm-threads.c:117 #7 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6b67cf030, s=0x7fc6b9cedd30, p=0x7fc4c64ff660) at ./tm-threads.h:195 #8 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc4cffff680, pbd=0x7fbf32200000, ppd=0x7fbf3222b068) at source-af-packet.c:983 #9 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc4cffff680, pbd=0x7fbf32200000) at source-af-packet.c:996 #10 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc4cffff680) at source-af-packet.c:1043 #11 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6b67cf030, data=0x7fc4cffff680, slot=0x7fc6b7a1b030) at source-af-packet.c:1393 #12 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6b67cf030) at tm-threads.c:312 #13 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 51 (Thread 0x7fc4f175b700 (LWP 58645)): #0 0x00007fc83071df76 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007fc8307555a5 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x00007fc83065947b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #3 0x0000000000523e86 in SCHSSearch (mpm_ctx=0x7fc6997cd8f0, mpm_thread_ctx=0x7fc4ab882828, pmq=0x7fc4ab882858, buf=0x7fbf0ad7051c , buflen=474) at util-mpm-hs.c:946 #4 0x00000000005a23e8 in PrefilterPktPayload (det_ctx=0x7fc4ab882740, p=0x7fc4b64ff660, pectx=0x7fc6997cd8f0) at detect-engine-payload.c:122 #5 0x00000000005a5b4c in Prefilter (det_ctx=0x7fc4ab882740, sgh=0x7fc698f1f2c0, p=0x7fc4b64ff660, flags=8 '\b') at detect-engine-prefilter.c:182 #6 0x00000000006f2620 in DetectRunPrefilterPkt (tv=0x7fc6b0a035f0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc4ab882740, p=0x7fc4b64ff660, scratch=0x7fc4f175a6f0) at detect.c:686 #7 0x00000000006f1d01 in DetectRun (th_v=0x7fc6b0a035f0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc4ab882740, p=0x7fc4b64ff660) at detect.c:132 #8 0x00000000006f19ff in DetectFlow (tv=0x7fc6b0a035f0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc4ab882740, p=0x7fc4b64ff660) at detect.c:1681 #9 0x00000000006f18a8 in Detect (tv=0x7fc6b0a035f0, p=0x7fc4b64ff660, data=0x7fc4ab882740) at detect.c:1753 #10 0x0000000000611758 in FlowWorker (tv=0x7fc6b0a035f0, p=0x7fc4b64ff660, data=0x7fc4b653b0f0) at flow-worker.c:552 #11 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6b0a035f0, p=0x7fc4b64ff660, slot=0x7fc6ae03c3c0) at tm-threads.c:117 #12 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6b0a035f0, s=0x7fc6ae03c3c0, p=0x7fc4b64ff660) at ./tm-threads.h:195 #13 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc4bffff680, pbd=0x7fbf0ac00000, ppd=0x7fbf0ad70490) at source-af-packet.c:983 #14 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc4bffff680, pbd=0x7fbf0ac00000) at source-af-packet.c:996 #15 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc4bffff680) at source-af-packet.c:1043 #16 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6b0a035f0, data=0x7fc4bffff680, slot=0x7fc6aa642900) at source-af-packet.c:1393 #17 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6b0a035f0) at tm-threads.c:312 #18 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #19 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 50 (Thread 0x7fc45975b700 (LWP 58654)): #0 0x00000000006f2735 in DetectRulePacketRules (tv=0x7fc6ba8b0650, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc413882740, p=0x7fc41e4ff660, pflow=0x7fac92d94620, scratch=0x7fc45975a6f0) at detect.c:754 #1 0x00000000006f1d1e in DetectRun (th_v=0x7fc6ba8b0650, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc413882740, p=0x7fc41e4ff660) at detect.c:136 #2 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba8b0650, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc413882740, p=0x7fc41e4ff660) at detect.c:1681 #3 0x00000000006f18a8 in Detect (tv=0x7fc6ba8b0650, p=0x7fc41e4ff660, data=0x7fc413882740) at detect.c:1753 #4 0x0000000000611758 in FlowWorker (tv=0x7fc6ba8b0650, p=0x7fc41e4ff660, data=0x7fc41e53b0f0) at flow-worker.c:552 #5 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba8b0650, p=0x7fc41e4ff660, slot=0x7fc6b2ae6e60) at tm-threads.c:117 #6 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba8b0650, s=0x7fc6b2ae6e60, p=0x7fc41e4ff660) at ./tm-threads.h:195 #7 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc427fff680, pbd=0x7fbe12e00000, ppd=0x7fbe12e31218) at source-af-packet.c:983 #8 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc427fff680, pbd=0x7fbe12e00000) at source-af-packet.c:996 #9 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc427fff680) at source-af-packet.c:1043 #10 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba8b0650, data=0x7fc427fff680, slot=0x7fc6b2bd4cf0) at source-af-packet.c:1393 #11 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba8b0650) at tm-threads.c:312 #12 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #13 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 49 (Thread 0x7fc3c175b700 (LWP 58663)): #0 0x00000000006f3f14 in DetectPrefilterBuildNonPrefilterList (det_ctx=0x7fc37b882740, mask=131 '\203', alproto=0 '\000') at detect.c:378 #1 0x00000000006f2603 in DetectRunPrefilterPkt (tv=0x7fc6ba7321c0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc37b882740, p=0x7fc3864ff660, scratch=0x7fc3c175a6f0) at detect.c:681 #2 0x00000000006f1d01 in DetectRun (th_v=0x7fc6ba7321c0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc37b882740, p=0x7fc3864ff660) at detect.c:132 #3 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba7321c0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc37b882740, p=0x7fc3864ff660) at detect.c:1681 #4 0x00000000006f18a8 in Detect (tv=0x7fc6ba7321c0, p=0x7fc3864ff660, data=0x7fc37b882740) at detect.c:1753 #5 0x0000000000611758 in FlowWorker (tv=0x7fc6ba7321c0, p=0x7fc3864ff660, data=0x7fc38653b0f0) at flow-worker.c:552 #6 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba7321c0, p=0x7fc3864ff660, slot=0x7fc6ba0bc5b0) at tm-threads.c:117 #7 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba7321c0, s=0x7fc6ba0bc5b0, p=0x7fc3864ff660) at ./tm-threads.h:195 #8 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc38ffff680, pbd=0x7fbd01800000, ppd=0x7fbd0195fbe0) at source-af-packet.c:983 #9 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc38ffff680, pbd=0x7fbd01800000) at source-af-packet.c:996 #10 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc38ffff680) at source-af-packet.c:1043 #11 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba7321c0, data=0x7fc38ffff680, slot=0x7fc6a38186c0) at source-af-packet.c:1393 #12 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba7321c0) at tm-threads.c:312 #13 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 48 (Thread 0x7fc3c3273700 (LWP 58661)): #0 0x00007fc830737964 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007fc830758a56 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x00007fc83075d5ad in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #3 0x00007fc8307572c7 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #4 0x00007fc83065947b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #5 0x0000000000523e86 in SCHSSearch (mpm_ctx=0x7fc6997c55d0, mpm_thread_ctx=0x7fc39b882828, pmq=0x7fc39b882858, buf=0x7fbd3baa34b0 , buflen=1366) at util-mpm-hs.c:946 #6 0x00000000005a23e8 in PrefilterPktPayload (det_ctx=0x7fc39b882740, p=0x7fc3a64ff660, pectx=0x7fc6997c55d0) at detect-engine-payload.c:122 #7 0x00000000005a5b4c in Prefilter (det_ctx=0x7fc39b882740, sgh=0x7fc6997c8280, p=0x7fc3a64ff660, flags=4 '\004') at detect-engine-prefilter.c:182 #8 0x00000000006f2620 in DetectRunPrefilterPkt (tv=0x7fc6ba715090, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc39b882740, p=0x7fc3a64ff660, scratch=0x7fc3c32726f0) at detect.c:686 #9 0x00000000006f1d01 in DetectRun (th_v=0x7fc6ba715090, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc39b882740, p=0x7fc3a64ff660) at detect.c:132 #10 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba715090, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc39b882740, p=0x7fc3a64ff660) at detect.c:1681 #11 0x00000000006f18a8 in Detect (tv=0x7fc6ba715090, p=0x7fc3a64ff660, data=0x7fc39b882740) at detect.c:1753 #12 0x0000000000611758 in FlowWorker (tv=0x7fc6ba715090, p=0x7fc3a64ff660, data=0x7fc3a653b0f0) at flow-worker.c:552 #13 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba715090, p=0x7fc3a64ff660, slot=0x7fc6b2c979f0) at tm-threads.c:117 #14 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba715090, s=0x7fc6b2c979f0, p=0x7fc3a64ff660) at ./tm-threads.h:195 #15 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc3affff680, pbd=0x7fbd3ba00000, ppd=0x7fbd3baa3420) at source-af-packet.c:983 #16 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc3affff680, pbd=0x7fbd3ba00000) at source-af-packet.c:996 #17 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc3affff680) at source-af-packet.c:1043 #18 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba715090, data=0x7fc3affff680, slot=0x7fc6a6815f60) at source-af-packet.c:1393 #19 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba715090) at tm-threads.c:312 #20 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #21 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 47 (Thread 0x7fc407a74700 (LWP 58656)): #0 0x00000000005a239d in PrefilterPktPayload (det_ctx=0x7fc3ef882740, p=0x7fc3fa4ff660, pectx=0x7fc699966b30) at detect-engine-payload.c:122 #1 0x00000000005a5b4c in Prefilter (det_ctx=0x7fc3ef882740, sgh=0x7fc698f20140, p=0x7fc3fa4ff660, flags=4 '\004') at detect-engine-prefilter.c:182 #2 0x00000000006f2620 in DetectRunPrefilterPkt (tv=0x7fc6ba901ec0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc3ef882740, p=0x7fc3fa4ff660, scratch=0x7fc407a736f0) at detect.c:686 #3 0x00000000006f1d01 in DetectRun (th_v=0x7fc6ba901ec0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc3ef882740, p=0x7fc3fa4ff660) at detect.c:132 #4 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba901ec0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc3ef882740, p=0x7fc3fa4ff660) at detect.c:1681 #5 0x00000000006f18a8 in Detect (tv=0x7fc6ba901ec0, p=0x7fc3fa4ff660, data=0x7fc3ef882740) at detect.c:1753 #6 0x0000000000611758 in FlowWorker (tv=0x7fc6ba901ec0, p=0x7fc3fa4ff660, data=0x7fc3fa53b0f0) at flow-worker.c:552 #7 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba901ec0, p=0x7fc3fa4ff660, slot=0x7fc6aa6e89e0) at tm-threads.c:117 #8 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba901ec0, s=0x7fc6aa6e89e0, p=0x7fc3fa4ff660) at ./tm-threads.h:195 #9 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc3fffff680, pbd=0x7fbdd5000000, ppd=0x7fbdd508ac48) at source-af-packet.c:983 #10 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc3fffff680, pbd=0x7fbdd5000000) at source-af-packet.c:996 #11 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc3fffff680) at source-af-packet.c:1043 #12 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba901ec0, data=0x7fc3fffff680, slot=0x7fc6b0027680) at source-af-packet.c:1393 #13 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba901ec0) at tm-threads.c:312 #14 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #15 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 46 (Thread 0x7fc5889cf700 (LWP 58637)): #0 0x00000000006f3f1b in DetectPrefilterBuildNonPrefilterList (det_ctx=0x7fc533882740, mask=131 '\203', alproto=4 '\004') at detect.c:378 #1 0x00000000006f2603 in DetectRunPrefilterPkt (tv=0x7fc6ab6a3650, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc533882740, p=0x7fc53e4fcd20, scratch=0x7fc5889ce580) at detect.c:681 #2 0x00000000006f1d01 in DetectRun (th_v=0x7fc6ab6a3650, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc533882740, p=0x7fc53e4fcd20) at detect.c:132 #3 0x00000000006f19ff in DetectFlow (tv=0x7fc6ab6a3650, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc533882740, p=0x7fc53e4fcd20) at detect.c:1681 #4 0x00000000006f18a8 in Detect (tv=0x7fc6ab6a3650, p=0x7fc53e4fcd20, data=0x7fc533882740) at detect.c:1753 #5 0x000000000061246d in FlowWorkerFlowTimeout (tv=0x7fc6ab6a3650, p=0x7fc53e4fcd20, fw=0x7fc53e53b0f0, detect_thread=0x7fc533882740) at flow-worker.c:421 #6 0x00000000006123d8 in FlowFinish (tv=0x7fc6ab6a3650, f=0x7facfa8c1280, fw=0x7fc53e53b0f0, detect_thread=0x7fc533882740) at flow-worker.c:157 #7 0x000000000061208c in CheckWorkQueue (tv=0x7fc6ab6a3650, fw=0x7fc53e53b0f0, detect_thread=0x7fc533882740, counters=0x7fc5889ce768, fq=0x7fc5889ce790) at flow-worker.c:177 #8 0x0000000000611ed9 in FlowWorkerProcessInjectedFlows (tv=0x7fc6ab6a3650, fw=0x7fc53e53b0f0, p=0x7fc53e4ff660, detect_thread=0x7fc533882740) at flow-worker.c:460 #9 0x000000000061189b in FlowWorker (tv=0x7fc6ab6a3650, p=0x7fc53e4ff660, data=0x7fc53e53b0f0) at flow-worker.c:590 #10 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ab6a3650, p=0x7fc53e4ff660, slot=0x7fc6aca30f80) at tm-threads.c:117 #11 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ab6a3650, s=0x7fc6aca30f80, p=0x7fc53e4ff660) at ./tm-threads.h:195 #12 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc547fff680, pbd=0x7fbffd000000, ppd=0x7fbffd0e63e8) at source-af-packet.c:983 #13 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc547fff680, pbd=0x7fbffd000000) at source-af-packet.c:996 #14 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc547fff680) at source-af-packet.c:1043 #15 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ab6a3650, data=0x7fc547fff680, slot=0x7fc6b612a8d0) at source-af-packet.c:1393 #16 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ab6a3650) at tm-threads.c:312 #17 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #18 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 45 (Thread 0x7fc3c3fff700 (LWP 58660)): #0 0x00000000006f28b8 in DetectRulePacketRules (tv=0x7fc6ba960300, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc3ab882740, p=0x7fc3b64ff660, pflow=0x7fc6bcff0fe0, scratch=0x7fc3c3ffe6f0) at detect.c:796 #1 0x00000000006f1d1e in DetectRun (th_v=0x7fc6ba960300, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc3ab882740, p=0x7fc3b64ff660) at detect.c:136 #2 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba960300, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc3ab882740, p=0x7fc3b64ff660) at detect.c:1681 #3 0x00000000006f18a8 in Detect (tv=0x7fc6ba960300, p=0x7fc3b64ff660, data=0x7fc3ab882740) at detect.c:1753 #4 0x0000000000611758 in FlowWorker (tv=0x7fc6ba960300, p=0x7fc3b64ff660, data=0x7fc3b653b0f0) at flow-worker.c:552 #5 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba960300, p=0x7fc3b64ff660, slot=0x7fc6b7eb37b0) at tm-threads.c:117 #6 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba960300, s=0x7fc6b7eb37b0, p=0x7fc3b64ff660) at ./tm-threads.h:195 #7 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc3bbfff680, pbd=0x7fbd59000000, ppd=0x7fbd590afa48) at source-af-packet.c:983 #8 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc3bbfff680, pbd=0x7fbd59000000) at source-af-packet.c:996 #9 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc3bbfff680) at source-af-packet.c:1043 #10 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba960300, data=0x7fc3bbfff680, slot=0x7fc6b9e5d270) at source-af-packet.c:1393 #11 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba960300) at tm-threads.c:312 #12 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #13 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 44 (Thread 0x7fc406ce8700 (LWP 58657)): #0 0x00000000006f4790 in DetectRunInspectRuleHeader (p=0x7fc3ea4ff660, f=0x7fc6be4ffbf0, s=0x7fc6bcd2f0e0, sflags=1572879, s_proto_flags=1 '\001') at detect.c:623 #1 0x00000000006f288b in DetectRulePacketRules (tv=0x7fc6ba916050, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc3df882740, p=0x7fc3ea4ff660, pflow=0x7fc6be4ffbf0, scratch=0x7fc406ce76f0) at detect.c:792 #2 0x00000000006f1d1e in DetectRun (th_v=0x7fc6ba916050, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc3df882740, p=0x7fc3ea4ff660) at detect.c:136 #3 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba916050, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc3df882740, p=0x7fc3ea4ff660) at detect.c:1681 #4 0x00000000006f18a8 in Detect (tv=0x7fc6ba916050, p=0x7fc3ea4ff660, data=0x7fc3df882740) at detect.c:1753 #5 0x0000000000611758 in FlowWorker (tv=0x7fc6ba916050, p=0x7fc3ea4ff660, data=0x7fc3ea53b0f0) at flow-worker.c:552 #6 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba916050, p=0x7fc3ea4ff660, slot=0x7fc6b37ba560) at tm-threads.c:117 #7 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba916050, s=0x7fc6b37ba560, p=0x7fc3ea4ff660) at ./tm-threads.h:195 #8 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc3f3fff680, pbd=0x7fbdbb800000, ppd=0x7fbdbb9537e8) at source-af-packet.c:983 #9 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc3f3fff680, pbd=0x7fbdbb800000) at source-af-packet.c:996 #10 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc3f3fff680) at source-af-packet.c:1043 #11 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba916050, data=0x7fc3f3fff680, slot=0x7fc69e231080) at source-af-packet.c:1393 #12 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba916050) at tm-threads.c:312 #13 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 43 (Thread 0x7fc45a4e7700 (LWP 58653)): #0 0x0000000000677f4f in TCPSEG_RB_MINMAX (head=0x7fb80279d208, val=-1) at stream-tcp-list.c:49 #1 0x0000000000678fbd in GetLeftEdge (f=0x7fb3bd08f240, ssn=0x7fb80279d100, stream=0x7fb80279d198) at stream-tcp-list.c:799 #2 0x00000000006789a8 in StreamTcpPruneSession (f=0x7fb3bd08f240, flags=4 '\004') at stream-tcp-list.c:871 #3 0x00000000006124cd in FlowWorkerFlowTimeout (tv=0x7fc6ba88bb10, p=0x7fc42e4fe1c0, fw=0x7fc42e53b0f0, detect_thread=0x7fc423882740) at flow-worker.c:434 #4 0x00000000006123af in FlowFinish (tv=0x7fc6ba88bb10, f=0x7fb3bd08f240, fw=0x7fc42e53b0f0, detect_thread=0x7fc423882740) at flow-worker.c:154 #5 0x000000000061208c in CheckWorkQueue (tv=0x7fc6ba88bb10, fw=0x7fc42e53b0f0, detect_thread=0x7fc423882740, counters=0x7fc45a4e6768, fq=0x7fc45a4e6790) at flow-worker.c:177 #6 0x0000000000611ed9 in FlowWorkerProcessInjectedFlows (tv=0x7fc6ba88bb10, fw=0x7fc42e53b0f0, p=0x7fc42e4ff660, detect_thread=0x7fc423882740) at flow-worker.c:460 #7 0x000000000061189b in FlowWorker (tv=0x7fc6ba88bb10, p=0x7fc42e4ff660, data=0x7fc42e53b0f0) at flow-worker.c:590 #8 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba88bb10, p=0x7fc42e4ff660, slot=0x7fc6ac9c09d0) at tm-threads.c:117 #9 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba88bb10, s=0x7fc6ac9c09d0, p=0x7fc42e4ff660) at ./tm-threads.h:195 #10 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc437fff680, pbd=0x7fbe2da00000, ppd=0x7fbe2da98980) at source-af-packet.c:983 #11 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc437fff680, pbd=0x7fbe2da00000) at source-af-packet.c:996 #12 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc437fff680) at source-af-packet.c:1043 #13 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba88bb10, data=0x7fc437fff680, slot=0x7fc6aa593160) at source-af-packet.c:1393 #14 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba88bb10) at tm-threads.c:312 #15 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #16 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 42 (Thread 0x7fc623fff700 (LWP 58624)): #0 0x00000000006f4af8 in DetectReplaceFree (det_ctx=0x7fc60b8824e0) at ./detect-replace.h:35 #1 0x00000000006f2914 in DetectRulePacketRules (tv=0x7fc690cdf810, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc60b8824e0, p=0x7fc6164ff660, pflow=0x7fb917ce0ef0, scratch=0x7fc623ffe6f0) at detect.c:808 #2 0x00000000006f1d1e in DetectRun (th_v=0x7fc690cdf810, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc60b8824e0, p=0x7fc6164ff660) at detect.c:136 #3 0x00000000006f19ff in DetectFlow (tv=0x7fc690cdf810, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc60b8824e0, p=0x7fc6164ff660) at detect.c:1681 #4 0x00000000006f18a8 in Detect (tv=0x7fc690cdf810, p=0x7fc6164ff660, data=0x7fc60b8824e0) at detect.c:1753 #5 0x0000000000611758 in FlowWorker (tv=0x7fc690cdf810, p=0x7fc6164ff660, data=0x7fc61653b0f0) at flow-worker.c:552 #6 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc690cdf810, p=0x7fc6164ff660, slot=0x7fc69f9a4a70) at tm-threads.c:117 #7 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc690cdf810, s=0x7fc69f9a4a70, p=0x7fc6164ff660) at ./tm-threads.h:195 #8 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc61bfff680, pbd=0x7fc169600000, ppd=0x7fc1696cf438) at source-af-packet.c:983 #9 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc61bfff680, pbd=0x7fc169600000) at source-af-packet.c:996 #10 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc61bfff680) at source-af-packet.c:1043 #11 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc690cdf810, data=0x7fc61bfff680, slot=0x7fc6b7573840) at source-af-packet.c:1393 #12 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc690cdf810) at tm-threads.c:312 #13 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 41 (Thread 0x7fc2909cf700 (LWP 58682)): #0 0x00007fc82fdaa3bf in __GI___clock_nanosleep (clock_id=clock_id@entry=0, flags=flags@entry=0, req=req@entry=0x7fc2909ce940, rem=rem@entry=0x0) at ../sysdeps/unix/sysv/linux/clock_nanosleep.c:78 #1 0x00007fc82fdb0047 in __GI___nanosleep (requested_time=requested_time@entry=0x7fc2909ce940, remaining=remaining@entry=0x0) at nanosleep.c:27 #2 0x00007fc82fde29bf in usleep (useconds=) at ../sysdeps/posix/usleep.c:32 #3 0x000000000060bff4 in FlowManager (th_v=0x7fc6ba680040, thread_data=0x7fc24c000b60) at flow-manager.c:971 #4 0x00000000005071e6 in TmThreadsManagement (td=0x7fc6ba680040) at tm-threads.c:552 #5 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #6 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 40 (Thread 0x7fc4f3273700 (LWP 58643)): #0 __memset_avx2_erms () at ../sysdeps/x86_64/multiarch/memset-vec-unaligned-erms.S:151 #1 0x00007fc82fd68f72 in __libc_calloc (n=, elem_size=) at malloc.c:3480 #2 0x00000000005209ad in SCCallocFunc (nm=1, sz=16773) at util-mem.c:57 #3 0x000000000054920d in HTPCalloc (n=1, size=16773) at app-layer-htp-mem.c:161 #4 0x000000000052ee6c in InitBuffer (sb=0x7faee8722f00) at util-streaming-buffer.c:104 #5 0x000000000052edbb in StreamingBufferInit (cfg=0xd2d020 ) at util-streaming-buffer.c:120 #6 0x00000000006e100e in HtpBodyAppendChunk (hcfg=0xd2d010 , body=0x7fb16ec2c738, data=0x7fb8cb477859 "PK", len=2) at app-layer-htp-body.c:92 #7 0x0000000000543f5c in HTPCallbackResponseBodyData (d=0x7fc4f3271ff0) at app-layer-htp.c:1977 #8 0x00007fc830bdeb61 in htp_hook_run_all (hook=0x1c40cc0, user_data=0x7fc4f3271ff0) at htp_hooks.c:127 #9 0x00007fc830beb7ec in htp_res_run_hook_body_data (connp=, d=) at htp_util.c:2337 #10 0x00007fc830be6723 in htp_tx_res_process_body_data_ex (tx=0x7fb16f8a3580, data=0x7fb8cb477859, len=140411458337680) at htp_transaction.c:1007 #11 0x00007fc830be3b51 in htp_connp_RES_BODY_IDENTITY_CL_KNOWN (connp=0x7faf8f63f260) at htp_response.c:487 #12 0x00007fc830be4945 in htp_connp_res_data (connp=0x7faf8f63f260, timestamp=, data=, len=) at htp_response.c:1321 #13 0x0000000000543281 in HTPHandleResponseData (f=0x7fc6c9335fc0, htp_state=0x7fb64de54140, pstate=0x7fb16ef679d0, stream_slice=..., local_data=0x0) at app-layer-htp.c:942 #14 0x000000000054f1fe in AppLayerParserParse (tv=0x7fc6a9f82cf0, alp_tctx=0x7fc4d659db30, f=0x7fc6c9335fc0, alproto=1, flags=11 '\v', input=0x7fb8cb477430 "HTTP/1.1 206 Partial Content\r\nCache-Control: public, max-age=17280000\r\nContent-Type: application/octet-stream\r\nAccept-Ranges: bytes\r\nServer: Microsoft-IIS/10.0\r\nX-AspNetMvc-Version: 5.2\r\nMS-Correlatio"..., input_len=1067) at app-layer-parser.c:1304 #15 0x000000000053599c in TCPProtoDetect (tv=0x7fc6a9f82cf0, ra_ctx=0x7fc4d6573c30, app_tctx=0x7fc4d6573c60, p=0x7fc4d64fec10, f=0x7fc6c9335fc0, ssn=0x7fb544809800, stream=0x7fc4f32724f0, data=0x7fb8cb477430 "HTTP/1.1 206 Partial Content\r\nCache-Control: public, max-age=17280000\r\nContent-Type: application/octet-stream\r\nAccept-Ranges: bytes\r\nServer: Microsoft-IIS/10.0\r\nX-AspNetMvc-Version: 5.2\r\nMS-Correlatio"..., data_len=1067, flags=11 '\v') at app-layer.c:461 #16 0x00000000005350e4 in AppLayerHandleTCPData (tv=0x7fc6a9f82cf0, ra_ctx=0x7fc4d6573c30, p=0x7fc4d64fec10, f=0x7fc6c9335fc0, ssn=0x7fb544809800, stream=0x7fc4f32724f0, data=0x7fb8cb477430 "HTTP/1.1 206 Partial Content\r\nCache-Control: public, max-age=17280000\r\nContent-Type: application/octet-stream\r\nAccept-Ranges: bytes\r\nServer: Microsoft-IIS/10.0\r\nX-AspNetMvc-Version: 5.2\r\nMS-Correlatio"..., data_len=1067, flags=11 '\v') at app-layer.c:648 #17 0x000000000067b885 in ReassembleUpdateAppLayer (tv=0x7fc6a9f82cf0, ra_ctx=0x7fc4d6573c30, ssn=0x7fb544809800, stream=0x7fc4f32724f0, p=0x7fc4d64fec10, dir=UPDATE_DIR_PACKET) at stream-tcp-reassemble.c:1200 #18 0x000000000067b240 in StreamTcpReassembleAppLayer (tv=0x7fc6a9f82cf0, ra_ctx=0x7fc4d6573c30, ssn=0x7fb544809800, stream=0x7fb544809810, p=0x7fc4d64fec10, dir=UPDATE_DIR_PACKET) at stream-tcp-reassemble.c:1264 #19 0x000000000067cf60 in StreamTcpReassembleHandleSegment (tv=0x7fc6a9f82cf0, ra_ctx=0x7fc4d6573c30, ssn=0x7fb544809800, stream=0x7fb544809810, p=0x7fc4d64fec10, pq=0x7fc4d653b120) at stream-tcp-reassemble.c:1930 #20 0x00000000006617d2 in StreamTcpPacket (tv=0x7fc6a9f82cf0, p=0x7fc4d64fec10, stt=0x7fc4dffffc70, pq=0x7fc4d653b120) at stream-tcp.c:4936 #21 0x0000000000664136 in StreamTcp (tv=0x7fc6a9f82cf0, p=0x7fc4d64fec10, data=0x7fc4dffffc70, pq=0x7fc4d653b120) at stream-tcp.c:5312 #22 0x0000000000611bb3 in FlowWorkerStreamTCPUpdate (tv=0x7fc6a9f82cf0, fw=0x7fc4d653b0f0, p=0x7fc4d64fec10, detect_thread=0x7fc4cb882740, timeout=true) at flow-worker.c:370 #23 0x0000000000612438 in FlowWorkerFlowTimeout (tv=0x7fc6a9f82cf0, p=0x7fc4d64fec10, fw=0x7fc4d653b0f0, detect_thread=0x7fc4cb882740) at flow-worker.c:413 #24 0x00000000006123d8 in FlowFinish (tv=0x7fc6a9f82cf0, f=0x7fc6c9335fc0, fw=0x7fc4d653b0f0, detect_thread=0x7fc4cb882740) at flow-worker.c:157 #25 0x000000000061208c in CheckWorkQueue (tv=0x7fc6a9f82cf0, fw=0x7fc4d653b0f0, detect_thread=0x7fc4cb882740, counters=0x7fc4f3272768, fq=0x7fc4f3272790) at flow-worker.c:177 #26 0x0000000000611ed9 in FlowWorkerProcessInjectedFlows (tv=0x7fc6a9f82cf0, fw=0x7fc4d653b0f0, p=0x7fc4d64ff660, detect_thread=0x7fc4cb882740) at flow-worker.c:460 #27 0x000000000061189b in FlowWorker (tv=0x7fc6a9f82cf0, p=0x7fc4d64ff660, data=0x7fc4d653b0f0) at flow-worker.c:590 #28 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6a9f82cf0, p=0x7fc4d64ff660, slot=0x7fc6b673df10) at tm-threads.c:117 #29 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6a9f82cf0, s=0x7fc6b673df10, p=0x7fc4d64ff660) at ./tm-threads.h:195 #30 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc4dffff680, pbd=0x7fbf4f000000, ppd=0x7fbf4f024418) at source-af-packet.c:983 #31 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc4dffff680, pbd=0x7fbf4f000000) at source-af-packet.c:996 #32 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc4dffff680) at source-af-packet.c:1043 #33 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6a9f82cf0, data=0x7fc4dffff680, slot=0x7fc6b782b7a0) at source-af-packet.c:1393 #34 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6a9f82cf0) at tm-threads.c:312 #35 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #36 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 39 (Thread 0x7fc45b273700 (LWP 58652)): #0 0x00000000006f27d8 in DetectRulePacketRules (tv=0x7fc6baae3b40, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc433882740, p=0x7fc43e4ff660, pflow=0x7fc6be6f2db0, scratch=0x7fc45b2726f0) at detect.c:778 #1 0x00000000006f1d1e in DetectRun (th_v=0x7fc6baae3b40, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc433882740, p=0x7fc43e4ff660) at detect.c:136 #2 0x00000000006f19ff in DetectFlow (tv=0x7fc6baae3b40, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc433882740, p=0x7fc43e4ff660) at detect.c:1681 #3 0x00000000006f18a8 in Detect (tv=0x7fc6baae3b40, p=0x7fc43e4ff660, data=0x7fc433882740) at detect.c:1753 #4 0x0000000000611758 in FlowWorker (tv=0x7fc6baae3b40, p=0x7fc43e4ff660, data=0x7fc43e53b0f0) at flow-worker.c:552 #5 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6baae3b40, p=0x7fc43e4ff660, slot=0x7fc69ab66b70) at tm-threads.c:117 #6 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6baae3b40, s=0x7fc69ab66b70, p=0x7fc43e4ff660) at ./tm-threads.h:195 #7 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc447fff680, pbd=0x7fbe39a00000, ppd=0x7fbe39a66708) at source-af-packet.c:983 #8 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc447fff680, pbd=0x7fbe39a00000) at source-af-packet.c:996 #9 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc447fff680) at source-af-packet.c:1043 #10 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6baae3b40, data=0x7fc447fff680, slot=0x7fc6b7d327b0) at source-af-packet.c:1393 #11 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6baae3b40) at tm-threads.c:312 #12 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #13 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 38 (Thread 0x7fc49df5c700 (LWP 58649)): #0 0x00007fc83071deee in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007fc8307555a5 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x00007fc83065947b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #3 0x0000000000523e86 in SCHSSearch (mpm_ctx=0x7fc6997c55d0, mpm_thread_ctx=0x7fc467882828, pmq=0x7fc467882858, buf=0x7fbe8dc5da50 , buflen=1371) at util-mpm-hs.c:946 #4 0x00000000005a23e8 in PrefilterPktPayload (det_ctx=0x7fc467882740, p=0x7fc4724ff660, pectx=0x7fc6997c55d0) at detect-engine-payload.c:122 #5 0x00000000005a5b4c in Prefilter (det_ctx=0x7fc467882740, sgh=0x7fc6997c8280, p=0x7fc4724ff660, flags=4 '\004') at detect-engine-prefilter.c:182 #6 0x00000000006f2620 in DetectRunPrefilterPkt (tv=0x7fc6baab46a0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc467882740, p=0x7fc4724ff660, scratch=0x7fc49df5b6f0) at detect.c:686 #7 0x00000000006f1d01 in DetectRun (th_v=0x7fc6baab46a0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc467882740, p=0x7fc4724ff660) at detect.c:132 #8 0x00000000006f19ff in DetectFlow (tv=0x7fc6baab46a0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc467882740, p=0x7fc4724ff660) at detect.c:1681 #9 0x00000000006f18a8 in Detect (tv=0x7fc6baab46a0, p=0x7fc4724ff660, data=0x7fc467882740) at detect.c:1753 #10 0x0000000000611758 in FlowWorker (tv=0x7fc6baab46a0, p=0x7fc4724ff660, data=0x7fc47253b0f0) at flow-worker.c:552 #11 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6baab46a0, p=0x7fc4724ff660, slot=0x7fc6b9f1dbf0) at tm-threads.c:117 #12 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6baab46a0, s=0x7fc6b9f1dbf0, p=0x7fc4724ff660) at ./tm-threads.h:195 #13 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc47bfff680, pbd=0x7fbe8dc00000, ppd=0x7fbe8dc5d9b8) at source-af-packet.c:983 #14 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc47bfff680, pbd=0x7fbe8dc00000) at source-af-packet.c:996 #15 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc47bfff680) at source-af-packet.c:1043 #16 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6baab46a0, data=0x7fc47bfff680, slot=0x7fc6b79ecbf0) at source-af-packet.c:1393 #17 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6baab46a0) at tm-threads.c:312 #18 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #19 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 37 (Thread 0x7fc49d1d0700 (LWP 58650)): #0 0x000000000054e150 in AppLayerParserGetDecoderEvents (pstate=0x7fb00b6b4fe0) at app-layer-parser.c:871 #1 0x000000000054f849 in AppLayerParserHasDecoderEvents (pstate=0x7fb00b6b4fe0) at app-layer-parser.c:1437 #2 0x00000000006f213d in DetectRunSetup (de_ctx=0x7fc6bce66f30, det_ctx=0x7fc457882740, p=0x7fc4624ff660, pflow=0x7fb518b33800) at detect.c:902 #3 0x00000000006f1ca0 in DetectRun (th_v=0x7fc6baabc7e0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc457882740, p=0x7fc4624ff660) at detect.c:117 #4 0x00000000006f19ff in DetectFlow (tv=0x7fc6baabc7e0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc457882740, p=0x7fc4624ff660) at detect.c:1681 #5 0x00000000006f18a8 in Detect (tv=0x7fc6baabc7e0, p=0x7fc4624ff660, data=0x7fc457882740) at detect.c:1753 #6 0x0000000000611758 in FlowWorker (tv=0x7fc6baabc7e0, p=0x7fc4624ff660, data=0x7fc46253b0f0) at flow-worker.c:552 #7 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6baabc7e0, p=0x7fc4624ff660, slot=0x7fc6ae0041b0) at tm-threads.c:117 #8 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6baabc7e0, s=0x7fc6ae0041b0, p=0x7fc4624ff660) at ./tm-threads.h:195 #9 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc46bfff680, pbd=0x7fbe86400000, ppd=0x7fbe8643a648) at source-af-packet.c:983 #10 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc46bfff680, pbd=0x7fbe86400000) at source-af-packet.c:996 #11 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc46bfff680) at source-af-packet.c:1043 #12 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6baabc7e0, data=0x7fc46bfff680, slot=0x7fc6a6a5ef60) at source-af-packet.c:1393 #13 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6baabc7e0) at tm-threads.c:312 #14 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #15 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 36 (Thread 0x7fc58a4e7700 (LWP 58635)): #0 0x00000000006f3f23 in DetectPrefilterBuildNonPrefilterList (det_ctx=0x7fc553882740, mask=131 '\203', alproto=0 '\000') at detect.c:379 #1 0x00000000006f2603 in DetectRunPrefilterPkt (tv=0x7fc6b01feb20, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc553882740, p=0x7fc55e4ff660, scratch=0x7fc58a4e66f0) at detect.c:681 #2 0x00000000006f1d01 in DetectRun (th_v=0x7fc6b01feb20, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc553882740, p=0x7fc55e4ff660) at detect.c:132 #3 0x00000000006f19ff in DetectFlow (tv=0x7fc6b01feb20, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc553882740, p=0x7fc55e4ff660) at detect.c:1681 #4 0x00000000006f18a8 in Detect (tv=0x7fc6b01feb20, p=0x7fc55e4ff660, data=0x7fc553882740) at detect.c:1753 #5 0x0000000000611758 in FlowWorker (tv=0x7fc6b01feb20, p=0x7fc55e4ff660, data=0x7fc55e53b0f0) at flow-worker.c:552 #6 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6b01feb20, p=0x7fc55e4ff660, slot=0x7fc6b79028b0) at tm-threads.c:117 #7 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6b01feb20, s=0x7fc6b79028b0, p=0x7fc55e4ff660) at ./tm-threads.h:195 #8 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc567fff680, pbd=0x7fc028600000, ppd=0x7fc02864cae0) at source-af-packet.c:983 #9 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc567fff680, pbd=0x7fc028600000) at source-af-packet.c:996 #10 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc567fff680) at source-af-packet.c:1043 #11 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6b01feb20, data=0x7fc567fff680, slot=0x7fc6b78fcdd0) at source-af-packet.c:1393 #12 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6b01feb20) at tm-threads.c:312 #13 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 35 (Thread 0x7fc45bfff700 (LWP 58651)): #0 0x00007fc83071defc in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007fc8307555a5 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x00007fc83065947b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #3 0x0000000000523e86 in SCHSSearch (mpm_ctx=0x7fc6997bba70, mpm_thread_ctx=0x7fc443882828, pmq=0x7fc443882858, buf=0x7fbe67692640 , buflen=1320) at util-mpm-hs.c:946 #4 0x00000000005a22e6 in PrefilterPktStream (det_ctx=0x7fc443882740, p=0x7fc44e4ff660, pectx=0x7fc6997bba70) at detect-engine-payload.c:99 #5 0x00000000005a5b4c in Prefilter (det_ctx=0x7fc443882740, sgh=0x7fc6997c8280, p=0x7fc44e4ff660, flags=4 '\004') at detect-engine-prefilter.c:182 #6 0x00000000006f2620 in DetectRunPrefilterPkt (tv=0x7fc6baac60c0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc443882740, p=0x7fc44e4ff660, scratch=0x7fc45bffe6f0) at detect.c:686 #7 0x00000000006f1d01 in DetectRun (th_v=0x7fc6baac60c0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc443882740, p=0x7fc44e4ff660) at detect.c:132 #8 0x00000000006f19ff in DetectFlow (tv=0x7fc6baac60c0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc443882740, p=0x7fc44e4ff660) at detect.c:1681 #9 0x00000000006f18a8 in Detect (tv=0x7fc6baac60c0, p=0x7fc44e4ff660, data=0x7fc443882740) at detect.c:1753 #10 0x0000000000611758 in FlowWorker (tv=0x7fc6baac60c0, p=0x7fc44e4ff660, data=0x7fc44e53b0f0) at flow-worker.c:552 #11 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6baac60c0, p=0x7fc44e4ff660, slot=0x7fc6a38ce2a0) at tm-threads.c:117 #12 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6baac60c0, s=0x7fc6a38ce2a0, p=0x7fc44e4ff660) at ./tm-threads.h:195 #13 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc453fff680, pbd=0x7fbe67600000, ppd=0x7fbe676925b0) at source-af-packet.c:983 #14 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc453fff680, pbd=0x7fbe67600000) at source-af-packet.c:996 #15 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc453fff680) at source-af-packet.c:1043 #16 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6baac60c0, data=0x7fc453fff680, slot=0x7fc6b6718a70) at source-af-packet.c:1393 #17 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6baac60c0) at tm-threads.c:312 #18 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #19 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 34 (Thread 0x7fc537a74700 (LWP 58638)): #0 0x000000000056072a in StatsAddUI64 (tv=0x7fc6a8025650, id=12, x=89) at counters.c:159 #1 0x0000000000569345 in DecodeUpdatePacketCounters (tv=0x7fc6a8025650, dtv=0x7fc52ffffcc0, p=0x7fc52a4ff660) at decode.c:624 #2 0x0000000000654024 in DecodeAFP (tv=0x7fc6a8025650, p=0x7fc52a4ff660, data=0x7fc52ffffcc0) at source-af-packet.c:2707 #3 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6a8025650, p=0x7fc52a4ff660, slot=0x7fc6b4ce3040) at tm-threads.c:117 #4 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6a8025650, s=0x7fc6b4ce3040, p=0x7fc52a4ff660) at ./tm-threads.h:195 #5 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc52ffff680, pbd=0x7fbfd8000000, ppd=0x7fbfd80db6a0) at source-af-packet.c:983 #6 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc52ffff680, pbd=0x7fbfd8000000) at source-af-packet.c:996 #7 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc52ffff680) at source-af-packet.c:1043 #8 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6a8025650, data=0x7fc52ffff680, slot=0x7fc6b4ce5550) at source-af-packet.c:1393 #9 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6a8025650) at tm-threads.c:312 #10 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #11 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 33 (Thread 0x7fc6209cf700 (LWP 58628)): #0 0x0000000000661b41 in StreamTcpPacket (tv=0x7fc6b4f932c0, p=0x7fc5d64ff660, stt=0x7fc5dffffc70, pq=0x7fc5d653b120) at stream-tcp.c:5035 #1 0x0000000000664136 in StreamTcp (tv=0x7fc6b4f932c0, p=0x7fc5d64ff660, data=0x7fc5dffffc70, pq=0x7fc5d653b120) at stream-tcp.c:5312 #2 0x0000000000611bb3 in FlowWorkerStreamTCPUpdate (tv=0x7fc6b4f932c0, fw=0x7fc5d653b0f0, p=0x7fc5d64ff660, detect_thread=0x7fc5cb882740, timeout=false) at flow-worker.c:370 #3 0x00000000006116d2 in FlowWorker (tv=0x7fc6b4f932c0, p=0x7fc5d64ff660, data=0x7fc5d653b0f0) at flow-worker.c:536 #4 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6b4f932c0, p=0x7fc5d64ff660, slot=0x7fc6a6a6b300) at tm-threads.c:117 #5 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6b4f932c0, s=0x7fc6a6a6b300, p=0x7fc5d64ff660) at ./tm-threads.h:195 #6 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc5dffff680, pbd=0x7fc0f4200000, ppd=0x7fc0f42559a8) at source-af-packet.c:983 #7 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc5dffff680, pbd=0x7fc0f4200000) at source-af-packet.c:996 #8 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc5dffff680) at source-af-packet.c:1043 #9 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6b4f932c0, data=0x7fc5dffff680, slot=0x7fc6a7d62220) at source-af-packet.c:1393 #10 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6b4f932c0) at tm-threads.c:312 #11 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #12 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 32 (Thread 0x7fc5351d0700 (LWP 58641)): #0 0x00000000006f3f02 in DetectPrefilterBuildNonPrefilterList (det_ctx=0x7fc4ef882740, mask=131 '\203', alproto=34 '"') at detect.c:377 #1 0x00000000006f2603 in DetectRunPrefilterPkt (tv=0x7fc6b572d3f0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc4ef882740, p=0x7fc4fa4ff660, scratch=0x7fc5351cf6f0) at detect.c:681 #2 0x00000000006f1d01 in DetectRun (th_v=0x7fc6b572d3f0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc4ef882740, p=0x7fc4fa4ff660) at detect.c:132 #3 0x00000000006f19ff in DetectFlow (tv=0x7fc6b572d3f0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc4ef882740, p=0x7fc4fa4ff660) at detect.c:1681 #4 0x00000000006f18a8 in Detect (tv=0x7fc6b572d3f0, p=0x7fc4fa4ff660, data=0x7fc4ef882740) at detect.c:1753 #5 0x0000000000611758 in FlowWorker (tv=0x7fc6b572d3f0, p=0x7fc4fa4ff660, data=0x7fc4fa53b0f0) at flow-worker.c:552 #6 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6b572d3f0, p=0x7fc4fa4ff660, slot=0x7fc6b9d17640) at tm-threads.c:117 #7 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6b572d3f0, s=0x7fc6b9d17640, p=0x7fc4fa4ff660) at ./tm-threads.h:195 #8 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc503fff680, pbd=0x7fbf7ea00000, ppd=0x7fbf7ea63d88) at source-af-packet.c:983 #9 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc503fff680, pbd=0x7fbf7ea00000) at source-af-packet.c:996 #10 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc503fff680) at source-af-packet.c:1043 #11 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6b572d3f0, data=0x7fc503fff680, slot=0x7fc6b2b174b0) at source-af-packet.c:1393 #12 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6b572d3f0) at tm-threads.c:312 #13 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 31 (Thread 0x7fc49ece8700 (LWP 58648)): #0 0x00007fc830985fc7 in __GI___pthread_mutex_lock (mutex=0x7fc6ea24d478) at ../nptl/pthread_mutex_lock.c:67 #1 0x000000000060904e in FromHashLockTO (f=0x7fc6ea24d3f0) at flow-hash.c:731 #2 0x00000000006089da in FlowGetFlowFromHash (tv=0x7fc6baa70290, fls=0x7fc48253b138, p=0x7fc4824ff660, dest=0x7fc4824ff698) at flow-hash.c:800 #3 0x0000000000605fc2 in FlowHandlePacket (tv=0x7fc6baa70290, fls=0x7fc48253b138, p=0x7fc4824ff660) at flow.c:512 #4 0x000000000061159a in FlowWorker (tv=0x7fc6baa70290, p=0x7fc4824ff660, data=0x7fc48253b0f0) at flow-worker.c:502 #5 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6baa70290, p=0x7fc4824ff660, slot=0x7fc6b9f02e30) at tm-threads.c:117 #6 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6baa70290, s=0x7fc6b9f02e30, p=0x7fc4824ff660) at ./tm-threads.h:195 #7 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc48bfff680, pbd=0x7fbec1600000, ppd=0x7fbec167d0c0) at source-af-packet.c:983 #8 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc48bfff680, pbd=0x7fbec1600000) at source-af-packet.c:996 #9 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc48bfff680) at source-af-packet.c:1043 #10 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6baa70290, data=0x7fc48bfff680, slot=0x7fc6b9ef4000) at source-af-packet.c:1393 #11 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6baa70290) at tm-threads.c:312 #12 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #13 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 30 (Thread 0x7fc5cdf5c700 (LWP 58631)): #0 PacketSetData (p=0x7fc5a24ff660, pktdata=0x7fc08e22b762 , pktlen=405) at decode.c:694 #1 0x000000000065963e in UpdateRawDataForVLANHdr (p=0x7fc5a24ff660) at source-af-packet.c:2681 #2 0x00000000006540c7 in DecodeAFP (tv=0x7fc6bc117300, p=0x7fc5a24ff660, data=0x7fc5abfffcc0) at source-af-packet.c:2714 #3 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6bc117300, p=0x7fc5a24ff660, slot=0x7fc69b130570) at tm-threads.c:117 #4 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6bc117300, s=0x7fc69b130570, p=0x7fc5a24ff660) at ./tm-threads.h:195 #5 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc5abfff680, pbd=0x7fc08e200000, ppd=0x7fc08e22b710) at source-af-packet.c:983 #6 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc5abfff680, pbd=0x7fc08e200000) at source-af-packet.c:996 #7 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc5abfff680) at source-af-packet.c:1043 #8 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6bc117300, data=0x7fc5abfff680, slot=0x7fc6aca67540) at source-af-packet.c:1393 #9 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6bc117300) at tm-threads.c:312 #10 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #11 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 29 (Thread 0x7fc623273700 (LWP 58625)): #0 0x000000000058d9fc in DetectEngineInspectRulePacketMatches (det_ctx=0x7fc5fb882740, engine=0x7fc69f305f70, s=0x7fc6bceff800, p=0x7fc6064ff660, _alert_flags=0x7fc623272677 "") at detect-engine.c:1749 #1 0x000000000058d5d8 in DetectEnginePktInspectionRun (tv=0x7fc6b4f79140, det_ctx=0x7fc5fb882740, s=0x7fc6bceff800, f=0x7fc6bd50f5e0, p=0x7fc6064ff660, alert_flags=0x7fc623272677 "") at detect-engine.c:1814 #2 0x00000000006f28b6 in DetectRulePacketRules (tv=0x7fc6b4f79140, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc5fb882740, p=0x7fc6064ff660, pflow=0x7fc6bd50f5e0, scratch=0x7fc6232726f0) at detect.c:796 #3 0x00000000006f1d1e in DetectRun (th_v=0x7fc6b4f79140, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc5fb882740, p=0x7fc6064ff660) at detect.c:136 #4 0x00000000006f19ff in DetectFlow (tv=0x7fc6b4f79140, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc5fb882740, p=0x7fc6064ff660) at detect.c:1681 #5 0x00000000006f18a8 in Detect (tv=0x7fc6b4f79140, p=0x7fc6064ff660, data=0x7fc5fb882740) at detect.c:1753 #6 0x0000000000611758 in FlowWorker (tv=0x7fc6b4f79140, p=0x7fc6064ff660, data=0x7fc60653b0f0) at flow-worker.c:552 #7 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6b4f79140, p=0x7fc6064ff660, slot=0x7fc6b9b94140) at tm-threads.c:117 #8 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6b4f79140, s=0x7fc6b9b94140, p=0x7fc6064ff660) at ./tm-threads.h:195 #9 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc60ffff680, pbd=0x7fc14ea00000, ppd=0x7fc14ea29de8) at source-af-packet.c:983 #10 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc60ffff680, pbd=0x7fc14ea00000) at source-af-packet.c:996 #11 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc60ffff680) at source-af-packet.c:1043 #12 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6b4f79140, data=0x7fc60ffff680, slot=0x7fc6aa10ab30) at source-af-packet.c:1393 #13 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6b4f79140) at tm-threads.c:312 #14 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #15 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 28 (Thread 0x7fc6224e7700 (LWP 58626)): #0 0x000000000057f201 in DetectAddressMatchIPv4 (addrs=0x7fc6b6e82e80, addrs_cnt=27, a=0x7fc5f64ff660) at detect-engine-address.c:1648 #1 0x00000000006f4941 in DetectRunInspectRuleHeader (p=0x7fc5f64ff660, f=0x7fb5d9249cd0, s=0x7fc6b6e86e00, sflags=9963524, s_proto_flags=0 '\000') at detect.c:650 #2 0x00000000006f288b in DetectRulePacketRules (tv=0x7fc6b4f82e30, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc5eb882740, p=0x7fc5f64ff660, pflow=0x7fb5d9249cd0, scratch=0x7fc6224e66f0) at detect.c:792 #3 0x00000000006f1d1e in DetectRun (th_v=0x7fc6b4f82e30, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc5eb882740, p=0x7fc5f64ff660) at detect.c:136 #4 0x00000000006f19ff in DetectFlow (tv=0x7fc6b4f82e30, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc5eb882740, p=0x7fc5f64ff660) at detect.c:1681 #5 0x00000000006f18a8 in Detect (tv=0x7fc6b4f82e30, p=0x7fc5f64ff660, data=0x7fc5eb882740) at detect.c:1753 #6 0x0000000000611758 in FlowWorker (tv=0x7fc6b4f82e30, p=0x7fc5f64ff660, data=0x7fc5f653b0f0) at flow-worker.c:552 #7 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6b4f82e30, p=0x7fc5f64ff660, slot=0x7fc69eebc880) at tm-threads.c:117 #8 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6b4f82e30, s=0x7fc69eebc880, p=0x7fc5f64ff660) at ./tm-threads.h:195 #9 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc5fffff680, pbd=0x7fc12f600000, ppd=0x7fc12f6b21a8) at source-af-packet.c:983 #10 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc5fffff680, pbd=0x7fc12f600000) at source-af-packet.c:996 #11 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc5fffff680) at source-af-packet.c:1043 #12 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6b4f82e30, data=0x7fc5fffff680, slot=0x7fc6af3177e0) at source-af-packet.c:1393 #13 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6b4f82e30) at tm-threads.c:312 #14 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #15 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 27 (Thread 0x7fc293fff700 (LWP 58678)): #0 DetectRulePacketRules (tv=0x7fc6ba622480, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc27b882740, p=0x7fc2864ff660, pflow=0x7fb52ed06f50, scratch=0x7fc293ffe6f0) at detect.c:808 #1 0x00000000006f1d1e in DetectRun (th_v=0x7fc6ba622480, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc27b882740, p=0x7fc2864ff660) at detect.c:136 #2 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba622480, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc27b882740, p=0x7fc2864ff660) at detect.c:1681 #3 0x00000000006f18a8 in Detect (tv=0x7fc6ba622480, p=0x7fc2864ff660, data=0x7fc27b882740) at detect.c:1753 #4 0x0000000000611758 in FlowWorker (tv=0x7fc6ba622480, p=0x7fc2864ff660, data=0x7fc28653b0f0) at flow-worker.c:552 #5 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba622480, p=0x7fc2864ff660, slot=0x7fc6ba1b2f90) at tm-threads.c:117 #6 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba622480, s=0x7fc6ba1b2f90, p=0x7fc2864ff660) at ./tm-threads.h:195 #7 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc28bfff680, pbd=0x7fbb52e00000, ppd=0x7fbb52e85468) at source-af-packet.c:983 #8 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc28bfff680, pbd=0x7fbb52e00000) at source-af-packet.c:996 #9 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc28bfff680) at source-af-packet.c:1043 #10 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba622480, data=0x7fc28bfff680, slot=0x7fc6b814dce0) at source-af-packet.c:1393 #11 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba622480) at tm-threads.c:312 #12 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #13 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 26 (Thread 0x7fc293273700 (LWP 58679)): #0 0x000000000059729c in IPOnlyMatchPacket (tv=0x7fc6ba647180, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc26b882740, io_ctx=0x7fc6bce67fd0, io_tctx=0x7fc26b882870, p=0x7fc2764ff660) at detect-engine-iponly.c:1044 #1 0x00000000006f2294 in DetectRunInspectIPOnly (tv=0x7fc6ba647180, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc26b882740, pflow=0x7fc6e865fa20, p=0x7fc2764ff660) at detect.c:557 #2 0x00000000006f1cb9 in DetectRun (th_v=0x7fc6ba647180, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc26b882740, p=0x7fc2764ff660) at detect.c:120 #3 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba647180, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc26b882740, p=0x7fc2764ff660) at detect.c:1681 #4 0x00000000006f18a8 in Detect (tv=0x7fc6ba647180, p=0x7fc2764ff660, data=0x7fc26b882740) at detect.c:1753 #5 0x0000000000611758 in FlowWorker (tv=0x7fc6ba647180, p=0x7fc2764ff660, data=0x7fc27653b0f0) at flow-worker.c:552 #6 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba647180, p=0x7fc2764ff660, slot=0x7fc6ba1d9900) at tm-threads.c:117 #7 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba647180, s=0x7fc6ba1d9900, p=0x7fc2764ff660) at ./tm-threads.h:195 #8 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc27ffff680, pbd=0x7fbb45200000, ppd=0x7fbb45218fc8) at source-af-packet.c:983 #9 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc27ffff680, pbd=0x7fbb45200000) at source-af-packet.c:996 #10 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc27ffff680) at source-af-packet.c:1043 #11 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba647180, data=0x7fc27ffff680, slot=0x7fc6ba1c3a60) at source-af-packet.c:1393 #12 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba647180) at tm-threads.c:312 #13 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 25 (Thread 0x7fc3c24e7700 (LWP 58662)): #0 0x00000000006f49bb in DetectRunInspectRuleHeader (p=0x7fc3964ff660, f=0x7fb46a14a970, s=0x7fc6bcf12d00, sflags=1572879, s_proto_flags=1 '\001') at detect.c:659 #1 0x00000000006f288b in DetectRulePacketRules (tv=0x7fc6ba719a10, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc38b882740, p=0x7fc3964ff660, pflow=0x7fb46a14a970, scratch=0x7fc3c24e66f0) at detect.c:792 #2 0x00000000006f1d1e in DetectRun (th_v=0x7fc6ba719a10, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc38b882740, p=0x7fc3964ff660) at detect.c:136 #3 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba719a10, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc38b882740, p=0x7fc3964ff660) at detect.c:1681 #4 0x00000000006f18a8 in Detect (tv=0x7fc6ba719a10, p=0x7fc3964ff660, data=0x7fc38b882740) at detect.c:1753 #5 0x0000000000611758 in FlowWorker (tv=0x7fc6ba719a10, p=0x7fc3964ff660, data=0x7fc39653b0f0) at flow-worker.c:552 #6 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba719a10, p=0x7fc3964ff660, slot=0x7fc69ffc5470) at tm-threads.c:117 #7 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba719a10, s=0x7fc69ffc5470, p=0x7fc3964ff660) at ./tm-threads.h:195 #8 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc39ffff680, pbd=0x7fbd27c00000, ppd=0x7fbd27c0c160) at source-af-packet.c:983 #9 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc39ffff680, pbd=0x7fbd27c00000) at source-af-packet.c:996 #10 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc39ffff680) at source-af-packet.c:1043 #11 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba719a10, data=0x7fc39ffff680, slot=0x7fc6ba0840c0) at source-af-packet.c:1393 #12 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba719a10) at tm-threads.c:312 #13 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 24 (Thread 0x7fc4f09cf700 (LWP 58646)): #0 DetectRulePacketRules (tv=0x7fc6a66a1d00, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc49b882740, p=0x7fc4a64ff660, pflow=0x7fb9b61a6ad0, scratch=0x7fc4f09ce6f0) at detect.c:796 #1 0x00000000006f1d1e in DetectRun (th_v=0x7fc6a66a1d00, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc49b882740, p=0x7fc4a64ff660) at detect.c:136 #2 0x00000000006f19ff in DetectFlow (tv=0x7fc6a66a1d00, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc49b882740, p=0x7fc4a64ff660) at detect.c:1681 #3 0x00000000006f18a8 in Detect (tv=0x7fc6a66a1d00, p=0x7fc4a64ff660, data=0x7fc49b882740) at detect.c:1753 #4 0x0000000000611758 in FlowWorker (tv=0x7fc6a66a1d00, p=0x7fc4a64ff660, data=0x7fc4a653b0f0) at flow-worker.c:552 #5 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6a66a1d00, p=0x7fc4a64ff660, slot=0x7fc6b7a06340) at tm-threads.c:117 #6 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6a66a1d00, s=0x7fc6b7a06340, p=0x7fc4a64ff660) at ./tm-threads.h:195 #7 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc4affff680, pbd=0x7fbef0e00000, ppd=0x7fbef0e66750) at source-af-packet.c:983 #8 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc4affff680, pbd=0x7fbef0e00000) at source-af-packet.c:996 #9 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc4affff680) at source-af-packet.c:1043 #10 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6a66a1d00, data=0x7fc4affff680, slot=0x7fc6b7a06940) at source-af-packet.c:1393 #11 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6a66a1d00) at tm-threads.c:312 #12 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #13 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 23 (Thread 0x7fc665f5c700 (LWP 58622)): #0 0x00007fc830659202 in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x0000000000523e86 in SCHSSearch (mpm_ctx=0x7fc6997cd8f0, mpm_thread_ctx=0x7fc62f882828, pmq=0x7fc62f882858, buf=0x7fc1ac89e210 , buflen=1238) at util-mpm-hs.c:946 #2 0x00000000005a23e8 in PrefilterPktPayload (det_ctx=0x7fc62f882740, p=0x7fc63a4ff660, pectx=0x7fc6997cd8f0) at detect-engine-payload.c:122 #3 0x00000000005a5b4c in Prefilter (det_ctx=0x7fc62f882740, sgh=0x7fc6996706a0, p=0x7fc63a4ff660, flags=8 '\b') at detect-engine-prefilter.c:182 #4 0x00000000006f2620 in DetectRunPrefilterPkt (tv=0x7fc68cf1d770, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc62f882740, p=0x7fc63a4ff660, scratch=0x7fc665f5b6f0) at detect.c:686 #5 0x00000000006f1d01 in DetectRun (th_v=0x7fc68cf1d770, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc62f882740, p=0x7fc63a4ff660) at detect.c:132 #6 0x00000000006f19ff in DetectFlow (tv=0x7fc68cf1d770, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc62f882740, p=0x7fc63a4ff660) at detect.c:1681 #7 0x00000000006f18a8 in Detect (tv=0x7fc68cf1d770, p=0x7fc63a4ff660, data=0x7fc62f882740) at detect.c:1753 #8 0x0000000000611758 in FlowWorker (tv=0x7fc68cf1d770, p=0x7fc63a4ff660, data=0x7fc63a53b0f0) at flow-worker.c:552 #9 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc68cf1d770, p=0x7fc63a4ff660, slot=0x7fc6b9ba8b70) at tm-threads.c:117 #10 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc68cf1d770, s=0x7fc6b9ba8b70, p=0x7fc63a4ff660) at ./tm-threads.h:195 #11 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc643fff680, pbd=0x7fc1ac800000, ppd=0x7fc1ac89e178) at source-af-packet.c:983 #12 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc643fff680, pbd=0x7fc1ac800000) at source-af-packet.c:996 #13 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc643fff680) at source-af-packet.c:1043 #14 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc68cf1d770, data=0x7fc643fff680, slot=0x7fc6b75a8af0) at source-af-packet.c:1393 #15 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc68cf1d770) at tm-threads.c:312 #16 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #17 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 22 (Thread 0x7fc666ce8700 (LWP 58621)): #0 0x00000000005a8a58 in DetectProtoContainsProto (dp=0x7fc6bcf0b972, proto=32710) at detect-engine-proto.c:136 #1 0x00000000006f46bc in DetectRunInspectRuleHeader (p=0x7fc64a4ff660, f=0x7fc6d65e15c0, s=0x7fc6bcf0b960, sflags=1572879, s_proto_flags=1 '\001') at detect.c:607 #2 0x00000000006f288b in DetectRulePacketRules (tv=0x7fc69913e2e0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc63f882740, p=0x7fc64a4ff660, pflow=0x7fc6d65e15c0, scratch=0x7fc666ce76f0) at detect.c:792 #3 0x00000000006f1d1e in DetectRun (th_v=0x7fc69913e2e0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc63f882740, p=0x7fc64a4ff660) at detect.c:136 #4 0x00000000006f19ff in DetectFlow (tv=0x7fc69913e2e0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc63f882740, p=0x7fc64a4ff660) at detect.c:1681 #5 0x00000000006f18a8 in Detect (tv=0x7fc69913e2e0, p=0x7fc64a4ff660, data=0x7fc63f882740) at detect.c:1753 #6 0x0000000000611758 in FlowWorker (tv=0x7fc69913e2e0, p=0x7fc64a4ff660, data=0x7fc64a53b0f0) at flow-worker.c:552 #7 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc69913e2e0, p=0x7fc64a4ff660, slot=0x7fc6b45dfd10) at tm-threads.c:117 #8 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc69913e2e0, s=0x7fc6b45dfd10, p=0x7fc64a4ff660) at ./tm-threads.h:195 #9 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc653fff680, pbd=0x7fc1c3c00000, ppd=0x7fc1c3c015b0) at source-af-packet.c:983 #10 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc653fff680, pbd=0x7fc1c3c00000) at source-af-packet.c:996 #11 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc653fff680) at source-af-packet.c:1043 #12 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc69913e2e0, data=0x7fc653fff680, slot=0x7fc6b763b4e0) at source-af-packet.c:1393 #13 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc69913e2e0) at tm-threads.c:312 #14 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #15 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 21 (Thread 0x7fc62175b700 (LWP 58627)): #0 0x00007fc83076e338 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007fc830669baf in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x00007fc83066ac25 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #3 0x00007fc83075552a in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #4 0x00007fc83065947b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #5 0x0000000000523e86 in SCHSSearch (mpm_ctx=0x7fc6997c55d0, mpm_thread_ctx=0x7fc5db882828, pmq=0x7fc5db882858, buf=0x7fc110250fe8 , buflen=1448) at util-mpm-hs.c:946 #6 0x00000000005a23e8 in PrefilterPktPayload (det_ctx=0x7fc5db882740, p=0x7fc5e64ff660, pectx=0x7fc6997c55d0) at detect-engine-payload.c:122 #7 0x00000000005a5b4c in Prefilter (det_ctx=0x7fc5db882740, sgh=0x7fc6997c8280, p=0x7fc5e64ff660, flags=4 '\004') at detect-engine-prefilter.c:182 #8 0x00000000006f2620 in DetectRunPrefilterPkt (tv=0x7fc6b4f82a70, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc5db882740, p=0x7fc5e64ff660, scratch=0x7fc62175a6f0) at detect.c:686 #9 0x00000000006f1d01 in DetectRun (th_v=0x7fc6b4f82a70, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc5db882740, p=0x7fc5e64ff660) at detect.c:132 #10 0x00000000006f19ff in DetectFlow (tv=0x7fc6b4f82a70, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc5db882740, p=0x7fc5e64ff660) at detect.c:1681 #11 0x00000000006f18a8 in Detect (tv=0x7fc6b4f82a70, p=0x7fc5e64ff660, data=0x7fc5db882740) at detect.c:1753 #12 0x0000000000611758 in FlowWorker (tv=0x7fc6b4f82a70, p=0x7fc5e64ff660, data=0x7fc5e653b0f0) at flow-worker.c:552 #13 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6b4f82a70, p=0x7fc5e64ff660, slot=0x7fc6b9b876b0) at tm-threads.c:117 #14 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6b4f82a70, s=0x7fc6b9b876b0, p=0x7fc5e64ff660) at ./tm-threads.h:195 #15 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc5effff680, pbd=0x7fc110200000, ppd=0x7fc110250f50) at source-af-packet.c:983 #16 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc5effff680, pbd=0x7fc110200000) at source-af-packet.c:996 #17 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc5effff680) at source-af-packet.c:1043 #18 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6b4f82a70, data=0x7fc5effff680, slot=0x7fc6b1557370) at source-af-packet.c:1393 #19 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6b4f82a70) at tm-threads.c:312 #20 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #21 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 20 (Thread 0x7fc32975b700 (LWP 58672)): #0 DetectVarProcessList (det_ctx=0x7fc2e3882740, f=0x7fc6bd1743f0, p=0x7fc2ee4ff660) at ./detect-flowvar.h:48 #1 0x00000000006f290b in DetectRulePacketRules (tv=0x7fc6ba5b5840, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc2e3882740, p=0x7fc2ee4ff660, pflow=0x7fc6bd1743f0, scratch=0x7fc32975a6f0) at detect.c:807 #2 0x00000000006f1d1e in DetectRun (th_v=0x7fc6ba5b5840, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc2e3882740, p=0x7fc2ee4ff660) at detect.c:136 #3 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba5b5840, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc2e3882740, p=0x7fc2ee4ff660) at detect.c:1681 #4 0x00000000006f18a8 in Detect (tv=0x7fc6ba5b5840, p=0x7fc2ee4ff660, data=0x7fc2e3882740) at detect.c:1753 #5 0x0000000000611758 in FlowWorker (tv=0x7fc6ba5b5840, p=0x7fc2ee4ff660, data=0x7fc2ee53b0f0) at flow-worker.c:552 #6 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba5b5840, p=0x7fc2ee4ff660, slot=0x7fc6ba23b4c0) at tm-threads.c:117 #7 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba5b5840, s=0x7fc6ba23b4c0, p=0x7fc2ee4ff660) at ./tm-threads.h:195 #8 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc2f7fff680, pbd=0x7fbc0d800000, ppd=0x7fbc0d8c2f28) at source-af-packet.c:983 #9 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc2f7fff680, pbd=0x7fbc0d800000) at source-af-packet.c:996 #10 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc2f7fff680) at source-af-packet.c:1043 #11 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba5b5840, data=0x7fc2f7fff680, slot=0x7fc6ae096cf0) at source-af-packet.c:1393 #12 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba5b5840) at tm-threads.c:312 #13 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 19 (Thread 0x7fc5cd1d0700 (LWP 58632)): #0 0x00000000006f4af8 in DetectReplaceFree (det_ctx=0x7fc587882740) at ./detect-replace.h:35 #1 0x00000000006f2914 in DetectRulePacketRules (tv=0x7fc6a1b6d7f0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc587882740, p=0x7fc5924ff660, pflow=0x7fc6bde0ac30, scratch=0x7fc5cd1cf6f0) at detect.c:808 #2 0x00000000006f1d1e in DetectRun (th_v=0x7fc6a1b6d7f0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc587882740, p=0x7fc5924ff660) at detect.c:136 #3 0x00000000006f19ff in DetectFlow (tv=0x7fc6a1b6d7f0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc587882740, p=0x7fc5924ff660) at detect.c:1681 #4 0x00000000006f18a8 in Detect (tv=0x7fc6a1b6d7f0, p=0x7fc5924ff660, data=0x7fc587882740) at detect.c:1753 #5 0x0000000000611758 in FlowWorker (tv=0x7fc6a1b6d7f0, p=0x7fc5924ff660, data=0x7fc59253b0f0) at flow-worker.c:552 #6 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6a1b6d7f0, p=0x7fc5924ff660, slot=0x7fc6b791ef80) at tm-threads.c:117 #7 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6a1b6d7f0, s=0x7fc6b791ef80, p=0x7fc5924ff660) at ./tm-threads.h:195 #8 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc59bfff680, pbd=0x7fc084000000, ppd=0x7fc08404a268) at source-af-packet.c:983 #9 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc59bfff680, pbd=0x7fc084000000) at source-af-packet.c:996 #10 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc59bfff680) at source-af-packet.c:1043 #11 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6a1b6d7f0, data=0x7fc59bfff680, slot=0x7fc6aa255030) at source-af-packet.c:1393 #12 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6a1b6d7f0) at tm-threads.c:312 #13 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 18 (Thread 0x7fc535f5c700 (LWP 58640)): #0 0x0000000000705994 in DetectEngineEventMatch (det_ctx=0x7fc4ff882740, p=0x7fc50a4ff660, s=0x7fc6bcf07900, ctx=0x7fc7f1412fd0) at detect-engine-event.c:100 #1 0x000000000058da18 in DetectEngineInspectRulePacketMatches (det_ctx=0x7fc4ff882740, engine=0x7fc69f2eb8c0, s=0x7fc6bcf085e0, p=0x7fc50a4ff660, _alert_flags=0x7fc535f5b677 "") at detect-engine.c:1749 #2 0x000000000058d5d8 in DetectEnginePktInspectionRun (tv=0x7fc6a79211c0, det_ctx=0x7fc4ff882740, s=0x7fc6bcf085e0, f=0x7fb5dbcfb400, p=0x7fc50a4ff660, alert_flags=0x7fc535f5b677 "") at detect-engine.c:1814 #3 0x00000000006f28b6 in DetectRulePacketRules (tv=0x7fc6a79211c0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc4ff882740, p=0x7fc50a4ff660, pflow=0x7fb5dbcfb400, scratch=0x7fc535f5b6f0) at detect.c:796 #4 0x00000000006f1d1e in DetectRun (th_v=0x7fc6a79211c0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc4ff882740, p=0x7fc50a4ff660) at detect.c:136 #5 0x00000000006f19ff in DetectFlow (tv=0x7fc6a79211c0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc4ff882740, p=0x7fc50a4ff660) at detect.c:1681 #6 0x00000000006f18a8 in Detect (tv=0x7fc6a79211c0, p=0x7fc50a4ff660, data=0x7fc4ff882740) at detect.c:1753 #7 0x0000000000611758 in FlowWorker (tv=0x7fc6a79211c0, p=0x7fc50a4ff660, data=0x7fc50a53b0f0) at flow-worker.c:552 #8 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6a79211c0, p=0x7fc50a4ff660, slot=0x7fc6a6aa6cd0) at tm-threads.c:117 #9 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6a79211c0, s=0x7fc6a6aa6cd0, p=0x7fc50a4ff660) at ./tm-threads.h:195 #10 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc513fff680, pbd=0x7fbf99000000, ppd=0x7fbf99091c00) at source-af-packet.c:983 #11 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc513fff680, pbd=0x7fbf99000000) at source-af-packet.c:996 #12 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc513fff680) at source-af-packet.c:1043 #13 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6a79211c0, data=0x7fc513fff680, slot=0x7fc6aeae6c00) at source-af-packet.c:1393 #14 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6a79211c0) at tm-threads.c:312 #15 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #16 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 17 (Thread 0x7fc58b273700 (LWP 58634)): #0 DetectRulePacketRules (tv=0x7fc6a1bdafd0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc563882740, p=0x7fc56e4ff660, pflow=0x7fb9b800beb0, scratch=0x7fc58b2726f0) at detect.c:811 #1 0x00000000006f1d1e in DetectRun (th_v=0x7fc6a1bdafd0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc563882740, p=0x7fc56e4ff660) at detect.c:136 #2 0x00000000006f19ff in DetectFlow (tv=0x7fc6a1bdafd0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc563882740, p=0x7fc56e4ff660) at detect.c:1681 #3 0x00000000006f18a8 in Detect (tv=0x7fc6a1bdafd0, p=0x7fc56e4ff660, data=0x7fc563882740) at detect.c:1753 #4 0x0000000000611758 in FlowWorker (tv=0x7fc6a1bdafd0, p=0x7fc56e4ff660, data=0x7fc56e53b0f0) at flow-worker.c:552 #5 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6a1bdafd0, p=0x7fc56e4ff660, slot=0x7fc6b9d8b840) at tm-threads.c:117 #6 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6a1bdafd0, s=0x7fc6b9d8b840, p=0x7fc56e4ff660) at ./tm-threads.h:195 #7 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc577fff680, pbd=0x7fc03f200000, ppd=0x7fc03f204bf8) at source-af-packet.c:983 #8 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc577fff680, pbd=0x7fc03f200000) at source-af-packet.c:996 #9 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc577fff680) at source-af-packet.c:1043 #10 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6a1bdafd0, data=0x7fc577fff680, slot=0x7fc6aa54f070) at source-af-packet.c:1393 #11 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6a1bdafd0) at tm-threads.c:312 #12 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #13 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 16 (Thread 0x7fc2d51d0700 (LWP 58677)): #0 0x000000000058d9f3 in DetectEngineInspectRulePacketMatches (det_ctx=0x7fc28f882740, engine=0x7fc69f2f0940, s=0x7fc6bcf0eca0, p=0x7fc29a4ff660, _alert_flags=0x7fc2d51cf677 "") at detect-engine.c:1749 #1 0x000000000058d5d8 in DetectEnginePktInspectionRun (tv=0x7fc6ba5f7a90, det_ctx=0x7fc28f882740, s=0x7fc6bcf0eca0, f=0x7facda07bc40, p=0x7fc29a4ff660, alert_flags=0x7fc2d51cf677 "") at detect-engine.c:1814 #2 0x00000000006f28b6 in DetectRulePacketRules (tv=0x7fc6ba5f7a90, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc28f882740, p=0x7fc29a4ff660, pflow=0x7facda07bc40, scratch=0x7fc2d51cf6f0) at detect.c:796 #3 0x00000000006f1d1e in DetectRun (th_v=0x7fc6ba5f7a90, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc28f882740, p=0x7fc29a4ff660) at detect.c:136 #4 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba5f7a90, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc28f882740, p=0x7fc29a4ff660) at detect.c:1681 #5 0x00000000006f18a8 in Detect (tv=0x7fc6ba5f7a90, p=0x7fc29a4ff660, data=0x7fc28f882740) at detect.c:1753 #6 0x0000000000611758 in FlowWorker (tv=0x7fc6ba5f7a90, p=0x7fc29a4ff660, data=0x7fc29a53b0f0) at flow-worker.c:552 #7 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba5f7a90, p=0x7fc29a4ff660, slot=0x7fc6b801bc30) at tm-threads.c:117 #8 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba5f7a90, s=0x7fc6b801bc30, p=0x7fc29a4ff660) at ./tm-threads.h:195 #9 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc2a3fff680, pbd=0x7fbb7da00000, ppd=0x7fbb7da58130) at source-af-packet.c:983 #10 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc2a3fff680, pbd=0x7fbb7da00000) at source-af-packet.c:996 #11 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc2a3fff680) at source-af-packet.c:1043 #12 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba5f7a90, data=0x7fc2a3fff680, slot=0x7fc6ac0f9430) at source-af-packet.c:1393 #13 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba5f7a90) at tm-threads.c:312 #14 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #15 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 15 (Thread 0x7fc6651d0700 (LWP 58623)): #0 0x00000000006f2735 in DetectRulePacketRules (tv=0x7fc687e78ed0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc61f882740, p=0x7fc62a4ff660, pflow=0x7fb878f031f0, scratch=0x7fc6651cf6f0) at detect.c:754 #1 0x00000000006f1d1e in DetectRun (th_v=0x7fc687e78ed0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc61f882740, p=0x7fc62a4ff660) at detect.c:136 #2 0x00000000006f19ff in DetectFlow (tv=0x7fc687e78ed0, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc61f882740, p=0x7fc62a4ff660) at detect.c:1681 #3 0x00000000006f18a8 in Detect (tv=0x7fc687e78ed0, p=0x7fc62a4ff660, data=0x7fc61f882740) at detect.c:1753 #4 0x0000000000611758 in FlowWorker (tv=0x7fc687e78ed0, p=0x7fc62a4ff660, data=0x7fc62a53b0f0) at flow-worker.c:552 #5 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc687e78ed0, p=0x7fc62a4ff660, slot=0x7fc6acec89f0) at tm-threads.c:117 #6 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc687e78ed0, s=0x7fc6acec89f0, p=0x7fc62a4ff660) at ./tm-threads.h:195 #7 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc633fff680, pbd=0x7fc188800000, ppd=0x7fc1888aa360) at source-af-packet.c:983 #8 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc633fff680, pbd=0x7fc188800000) at source-af-packet.c:996 #9 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc633fff680) at source-af-packet.c:1043 #10 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc687e78ed0, data=0x7fc633fff680, slot=0x7fc6b75e2770) at source-af-packet.c:1393 #11 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc687e78ed0) at tm-threads.c:312 #12 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #13 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 14 (Thread 0x7fc684b34700 (LWP 58619)): #0 0x00007fc83071df3c in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007fc8307555a5 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x00007fc83065947b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #3 0x0000000000523e86 in SCHSSearch (mpm_ctx=0x7fc6997c55d0, mpm_thread_ctx=0x7fc663882848, pmq=0x7fc663882878, buf=0x7fc1e9a02d2c , buflen=1380) at util-mpm-hs.c:946 #4 0x00000000005a23e8 in PrefilterPktPayload (det_ctx=0x7fc663882760, p=0x7fc66e4ff660, pectx=0x7fc6997c55d0) at detect-engine-payload.c:122 #5 0x00000000005a5b4c in Prefilter (det_ctx=0x7fc663882760, sgh=0x7fc6997c8280, p=0x7fc66e4ff660, flags=4 '\004') at detect-engine-prefilter.c:182 #6 0x00000000006f2620 in DetectRunPrefilterPkt (tv=0x7fc699406e20, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc663882760, p=0x7fc66e4ff660, scratch=0x7fc684b336f0) at detect.c:686 #7 0x00000000006f1d01 in DetectRun (th_v=0x7fc699406e20, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc663882760, p=0x7fc66e4ff660) at detect.c:132 #8 0x00000000006f19ff in DetectFlow (tv=0x7fc699406e20, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc663882760, p=0x7fc66e4ff660) at detect.c:1681 #9 0x00000000006f18a8 in Detect (tv=0x7fc699406e20, p=0x7fc66e4ff660, data=0x7fc663882760) at detect.c:1753 #10 0x0000000000611758 in FlowWorker (tv=0x7fc699406e20, p=0x7fc66e4ff660, data=0x7fc66e53b0f0) at flow-worker.c:552 #11 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc699406e20, p=0x7fc66e4ff660, slot=0x7fc698f8e180) at tm-threads.c:117 #12 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc699406e20, s=0x7fc698f8e180, p=0x7fc66e4ff660) at ./tm-threads.h:195 #13 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc677fff680, pbd=0x7fc1e9a00000, ppd=0x7fc1e9a02ca0) at source-af-packet.c:983 #14 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc677fff680, pbd=0x7fc1e9a00000) at source-af-packet.c:996 #15 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc677fff680) at source-af-packet.c:1043 #16 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc699406e20, data=0x7fc677fff680, slot=0x7fc699012580) at source-af-packet.c:1393 #17 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc699406e20) at tm-threads.c:312 #18 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #19 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 13 (Thread 0x7fc36df5c700 (LWP 58667)): #0 0x00007fc830668506 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007fc83066ac25 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x00007fc83075552a in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #3 0x00007fc83065947b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #4 0x0000000000523e86 in SCHSSearch (mpm_ctx=0x7fc699966b30, mpm_thread_ctx=0x7fc337882828, pmq=0x7fc337882858, buf=0x7fbc9001a0b0 , buflen=635) at util-mpm-hs.c:946 #5 0x00000000005a23e8 in PrefilterPktPayload (det_ctx=0x7fc337882740, p=0x7fc3424ff660, pectx=0x7fc699966b30) at detect-engine-payload.c:122 #6 0x00000000005a5b4c in Prefilter (det_ctx=0x7fc337882740, sgh=0x7fc699674880, p=0x7fc3424ff660, flags=4 '\004') at detect-engine-prefilter.c:182 #7 0x00000000006f2620 in DetectRunPrefilterPkt (tv=0x7fc6ba79f190, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc337882740, p=0x7fc3424ff660, scratch=0x7fc36df5b6f0) at detect.c:686 #8 0x00000000006f1d01 in DetectRun (th_v=0x7fc6ba79f190, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc337882740, p=0x7fc3424ff660) at detect.c:132 #9 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba79f190, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc337882740, p=0x7fc3424ff660) at detect.c:1681 #10 0x00000000006f18a8 in Detect (tv=0x7fc6ba79f190, p=0x7fc3424ff660, data=0x7fc337882740) at detect.c:1753 #11 0x0000000000611758 in FlowWorker (tv=0x7fc6ba79f190, p=0x7fc3424ff660, data=0x7fc34253b0f0) at flow-worker.c:552 #12 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba79f190, p=0x7fc3424ff660, slot=0x7fc69c693a90) at tm-threads.c:117 #13 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba79f190, s=0x7fc69c693a90, p=0x7fc3424ff660) at ./tm-threads.h:195 #14 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc34bfff680, pbd=0x7fbc90000000, ppd=0x7fbc9001a030) at source-af-packet.c:983 #15 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc34bfff680, pbd=0x7fbc90000000) at source-af-packet.c:996 #16 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc34bfff680) at source-af-packet.c:1043 #17 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba79f190, data=0x7fc34bfff680, slot=0x7fc6b7e6b670) at source-af-packet.c:1393 #18 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba79f190) at tm-threads.c:312 #19 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #20 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 12 (Thread 0x7fc3c09cf700 (LWP 58664)): #0 0x000000000065583d in AFPParsePacketV3 (ptv=0x7fc37ffff680, pbd=0x7fbce3000000, ppd=0x7fbce30af9b8) at source-af-packet.c:963 #1 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc37ffff680, pbd=0x7fbce3000000) at source-af-packet.c:996 #2 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc37ffff680) at source-af-packet.c:1043 #3 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba748250, data=0x7fc37ffff680, slot=0x7fc6ba070e30) at source-af-packet.c:1393 #4 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba748250) at tm-threads.c:312 #5 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #6 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 11 (Thread 0x7fc3289cf700 (LWP 58673)): #0 0x00000000006f2735 in DetectRulePacketRules (tv=0x7fc6ba5d4780, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc2d3882740, p=0x7fc2de4ff660, pflow=0x7fb1e24c7260, scratch=0x7fc3289ce6f0) at detect.c:754 #1 0x00000000006f1d1e in DetectRun (th_v=0x7fc6ba5d4780, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc2d3882740, p=0x7fc2de4ff660) at detect.c:136 #2 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba5d4780, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc2d3882740, p=0x7fc2de4ff660) at detect.c:1681 #3 0x00000000006f18a8 in Detect (tv=0x7fc6ba5d4780, p=0x7fc2de4ff660, data=0x7fc2d3882740) at detect.c:1753 #4 0x0000000000611758 in FlowWorker (tv=0x7fc6ba5d4780, p=0x7fc2de4ff660, data=0x7fc2de53b0f0) at flow-worker.c:552 #5 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba5d4780, p=0x7fc2de4ff660, slot=0x7fc69e2edc70) at tm-threads.c:117 #6 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba5d4780, s=0x7fc69e2edc70, p=0x7fc2de4ff660) at ./tm-threads.h:195 #7 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc2e7fff680, pbd=0x7fbbe4800000, ppd=0x7fbbe499a598) at source-af-packet.c:983 #8 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc2e7fff680, pbd=0x7fbbe4800000) at source-af-packet.c:996 #9 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc2e7fff680) at source-af-packet.c:1043 #10 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba5d4780, data=0x7fc2e7fff680, slot=0x7fc6ba238f00) at source-af-packet.c:1393 #11 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba5d4780) at tm-threads.c:312 #12 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #13 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 10 (Thread 0x7fc82faa5ac0 (LWP 58614)): #0 0x00007fc82fdaa3bf in __GI___clock_nanosleep (clock_id=clock_id@entry=0, flags=flags@entry=0, req=req@entry=0x7fffb5e2e6b0, rem=rem@entry=0x0) at ../sysdeps/unix/sysv/linux/clock_nanosleep.c:78 #1 0x00007fc82fdb0047 in __GI___nanosleep (requested_time=requested_time@entry=0x7fffb5e2e6b0, remaining=remaining@entry=0x0) at nanosleep.c:27 #2 0x00007fc82fde29bf in usleep (useconds=) at ../sysdeps/posix/usleep.c:32 #3 0x00000000004fdd08 in SuricataMainLoop (suri=0xd3c000 ) at suricata.c:2767 #4 0x00000000004faf0c in SuricataMain (argc=7, argv=0x7fffb5e2e878) at suricata.c:2935 #5 0x00000000004f91e2 in main (argc=7, argv=0x7fffb5e2e878) at main.c:22 Thread 9 (Thread 0x7fc58bfff700 (LWP 58633)): #0 0x00007fc830659202 in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x0000000000523e86 in SCHSSearch (mpm_ctx=0x7fc69977d520, mpm_thread_ctx=0x7fc573882828, pmq=0x7fc573882858, buf=0x7fc05c4783c0 , buflen=624) at util-mpm-hs.c:946 #2 0x00000000005a22e6 in PrefilterPktStream (det_ctx=0x7fc573882740, p=0x7fc57e4ff660, pectx=0x7fc69977d520) at detect-engine-payload.c:99 #3 0x00000000005a5b4c in Prefilter (det_ctx=0x7fc573882740, sgh=0x7fc6991f2b30, p=0x7fc57e4ff660, flags=8 '\b') at detect-engine-prefilter.c:182 #4 0x00000000006f2620 in DetectRunPrefilterPkt (tv=0x7fc6bac50b40, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc573882740, p=0x7fc57e4ff660, scratch=0x7fc58bffe6f0) at detect.c:686 #5 0x00000000006f1d01 in DetectRun (th_v=0x7fc6bac50b40, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc573882740, p=0x7fc57e4ff660) at detect.c:132 #6 0x00000000006f19ff in DetectFlow (tv=0x7fc6bac50b40, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc573882740, p=0x7fc57e4ff660) at detect.c:1681 #7 0x00000000006f18a8 in Detect (tv=0x7fc6bac50b40, p=0x7fc57e4ff660, data=0x7fc573882740) at detect.c:1753 #8 0x0000000000611758 in FlowWorker (tv=0x7fc6bac50b40, p=0x7fc57e4ff660, data=0x7fc57e53b0f0) at flow-worker.c:552 #9 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6bac50b40, p=0x7fc57e4ff660, slot=0x7fc6b2b3f970) at tm-threads.c:117 #10 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6bac50b40, s=0x7fc6b2b3f970, p=0x7fc57e4ff660) at ./tm-threads.h:195 #11 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc583fff680, pbd=0x7fc05c400000, ppd=0x7fc05c478330) at source-af-packet.c:983 #12 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc583fff680, pbd=0x7fc05c400000) at source-af-packet.c:996 #13 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc583fff680) at source-af-packet.c:1043 #14 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6bac50b40, data=0x7fc583fff680, slot=0x7fc6a36d2840) at source-af-packet.c:1393 #15 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6bac50b40) at tm-threads.c:312 #16 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #17 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 8 (Thread 0x7fc405f5c700 (LWP 58658)): #0 0x000000000058da02 in DetectEngineInspectRulePacketMatches (det_ctx=0x7fc3cf882740, engine=0x7fc69f2f18e0, s=0x7fc6bcefde40, p=0x7fc3da4ff660, _alert_flags=0x7fc405f5b677 "") at detect-engine.c:1749 #1 0x000000000058d5d8 in DetectEnginePktInspectionRun (tv=0x7fc6ba925500, det_ctx=0x7fc3cf882740, s=0x7fc6bcefde40, f=0x7fb5e21760b0, p=0x7fc3da4ff660, alert_flags=0x7fc405f5b677 "") at detect-engine.c:1814 #2 0x00000000006f28b6 in DetectRulePacketRules (tv=0x7fc6ba925500, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc3cf882740, p=0x7fc3da4ff660, pflow=0x7fb5e21760b0, scratch=0x7fc405f5b6f0) at detect.c:796 #3 0x00000000006f1d1e in DetectRun (th_v=0x7fc6ba925500, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc3cf882740, p=0x7fc3da4ff660) at detect.c:136 #4 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba925500, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc3cf882740, p=0x7fc3da4ff660) at detect.c:1681 #5 0x00000000006f18a8 in Detect (tv=0x7fc6ba925500, p=0x7fc3da4ff660, data=0x7fc3cf882740) at detect.c:1753 #6 0x0000000000611758 in FlowWorker (tv=0x7fc6ba925500, p=0x7fc3da4ff660, data=0x7fc3da53b0f0) at flow-worker.c:552 #7 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba925500, p=0x7fc3da4ff660, slot=0x7fc6acc936c0) at tm-threads.c:117 #8 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba925500, s=0x7fc6acc936c0, p=0x7fc3da4ff660) at ./tm-threads.h:195 #9 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc3e3fff680, pbd=0x7fbd9be00000, ppd=0x7fbd9be4ca50) at source-af-packet.c:983 #10 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc3e3fff680, pbd=0x7fbd9be00000) at source-af-packet.c:996 #11 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc3e3fff680) at source-af-packet.c:1043 #12 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba925500, data=0x7fc3e3fff680, slot=0x7fc6b30d06f0) at source-af-packet.c:1393 #13 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba925500) at tm-threads.c:312 #14 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #15 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 7 (Thread 0x7fc36d1d0700 (LWP 58668)): #0 0x00000000006f4337 in DetectPrefilterMergeSort (de_ctx=0x7fc6bce66f30, det_ctx=0x7fc327882740) at detect.c:353 #1 0x00000000006f264f in DetectRunPrefilterPkt (tv=0x7fc6ba7a7780, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc327882740, p=0x7fc3324ff660, scratch=0x7fc36d1cf6f0) at detect.c:695 #2 0x00000000006f1d01 in DetectRun (th_v=0x7fc6ba7a7780, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc327882740, p=0x7fc3324ff660) at detect.c:132 #3 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba7a7780, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc327882740, p=0x7fc3324ff660) at detect.c:1681 #4 0x00000000006f18a8 in Detect (tv=0x7fc6ba7a7780, p=0x7fc3324ff660, data=0x7fc327882740) at detect.c:1753 #5 0x0000000000611758 in FlowWorker (tv=0x7fc6ba7a7780, p=0x7fc3324ff660, data=0x7fc33253b0f0) at flow-worker.c:552 #6 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba7a7780, p=0x7fc3324ff660, slot=0x7fc6ba016de0) at tm-threads.c:117 #7 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba7a7780, s=0x7fc6ba016de0, p=0x7fc3324ff660) at ./tm-threads.h:195 #8 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc33bfff680, pbd=0x7fbc7e400000, ppd=0x7fbc7e4d99c0) at source-af-packet.c:983 #9 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc33bfff680, pbd=0x7fbc7e400000) at source-af-packet.c:996 #10 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc33bfff680) at source-af-packet.c:1043 #11 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba7a7780, data=0x7fc33bfff680, slot=0x7fc6a5f0cbd0) at source-af-packet.c:1393 #12 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba7a7780) at tm-threads.c:312 #13 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 6 (Thread 0x7fc667a74700 (LWP 58620)): #0 0x00007fc830757344 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007fc83065947b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x0000000000523e86 in SCHSSearch (mpm_ctx=0x7fc6997c55d0, mpm_thread_ctx=0x7fc64f882848, pmq=0x7fc64f882878, buf=0x7fc1d98449dc , buflen=75) at util-mpm-hs.c:946 #3 0x00000000005a23e8 in PrefilterPktPayload (det_ctx=0x7fc64f882760, p=0x7fc65a4ff660, pectx=0x7fc6997c55d0) at detect-engine-payload.c:122 #4 0x00000000005a5b4c in Prefilter (det_ctx=0x7fc64f882760, sgh=0x7fc6997c8280, p=0x7fc65a4ff660, flags=4 '\004') at detect-engine-prefilter.c:182 #5 0x00000000006f2620 in DetectRunPrefilterPkt (tv=0x7fc68d255930, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc64f882760, p=0x7fc65a4ff660, scratch=0x7fc667a736f0) at detect.c:686 #6 0x00000000006f1d01 in DetectRun (th_v=0x7fc68d255930, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc64f882760, p=0x7fc65a4ff660) at detect.c:132 #7 0x00000000006f19ff in DetectFlow (tv=0x7fc68d255930, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc64f882760, p=0x7fc65a4ff660) at detect.c:1681 #8 0x00000000006f18a8 in Detect (tv=0x7fc68d255930, p=0x7fc65a4ff660, data=0x7fc64f882760) at detect.c:1753 #9 0x0000000000611758 in FlowWorker (tv=0x7fc68d255930, p=0x7fc65a4ff660, data=0x7fc65a53b0f0) at flow-worker.c:552 #10 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc68d255930, p=0x7fc65a4ff660, slot=0x7fc6a7226610) at tm-threads.c:117 #11 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc68d255930, s=0x7fc6a7226610, p=0x7fc65a4ff660) at ./tm-threads.h:195 #12 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc65ffff680, pbd=0x7fc1d9800000, ppd=0x7fc1d9844950) at source-af-packet.c:983 #13 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc65ffff680, pbd=0x7fc1d9800000) at source-af-packet.c:996 #14 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc65ffff680) at source-af-packet.c:1043 #15 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc68d255930, data=0x7fc65ffff680, slot=0x7fc6a342b530) at source-af-packet.c:1393 #16 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc68d255930) at tm-threads.c:312 #17 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #18 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 5 (Thread 0x7fc6858c0700 (LWP 58618)): #0 0x00007fc83071deee in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007fc8307555a5 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x00007fc83065947b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #3 0x0000000000523e86 in SCHSSearch (mpm_ctx=0x7fc69973ae80, mpm_thread_ctx=0x7fc673885a28, pmq=0x7fc673885a58, buf=0x7fc204205a60 , buflen=102) at util-mpm-hs.c:946 #4 0x00000000005a23e8 in PrefilterPktPayload (det_ctx=0x7fc673885940, p=0x7fc67e4ff660, pectx=0x7fc69973ae80) at detect-engine-payload.c:122 #5 0x00000000005a5b4c in Prefilter (det_ctx=0x7fc673885940, sgh=0x7fc698f20bf0, p=0x7fc67e4ff660, flags=8 '\b') at detect-engine-prefilter.c:182 #6 0x00000000006f2620 in DetectRunPrefilterPkt (tv=0x7fc699406f50, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc673885940, p=0x7fc67e4ff660, scratch=0x7fc6858bf6f0) at detect.c:686 #7 0x00000000006f1d01 in DetectRun (th_v=0x7fc699406f50, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc673885940, p=0x7fc67e4ff660) at detect.c:132 #8 0x00000000006f19ff in DetectFlow (tv=0x7fc699406f50, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc673885940, p=0x7fc67e4ff660) at detect.c:1681 #9 0x00000000006f18a8 in Detect (tv=0x7fc699406f50, p=0x7fc67e4ff660, data=0x7fc673885940) at detect.c:1753 #10 0x0000000000611758 in FlowWorker (tv=0x7fc699406f50, p=0x7fc67e4ff660, data=0x7fc67e53e150) at flow-worker.c:552 #11 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc699406f50, p=0x7fc67e4ff660, slot=0x7fc6992ac5d0) at tm-threads.c:117 #12 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc699406f50, s=0x7fc6992ac5d0, p=0x7fc67e4ff660) at ./tm-threads.h:195 #13 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc683fff680, pbd=0x7fc204200000, ppd=0x7fc2042059e0) at source-af-packet.c:983 #14 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc683fff680, pbd=0x7fc204200000) at source-af-packet.c:996 #15 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc683fff680) at source-af-packet.c:1043 #16 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc699406f50, data=0x7fc683fff680, slot=0x7fc698faf4f0) at source-af-packet.c:1393 #17 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc699406f50) at tm-threads.c:312 #18 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #19 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 4 (Thread 0x7fc32a4e7700 (LWP 58671)): #0 0x0000000000608f7c in FlowIsTimedOut (f=0x7fb9b4b09970, sec=1645194698, emerg=false) at flow-hash.c:712 #1 0x00000000006089bc in FlowGetFlowFromHash (tv=0x7fc6ba5a3b30, fls=0x7fc2fe53b138, p=0x7fc2fe4ff660, dest=0x7fc2fe4ff698) at flow-hash.c:798 #2 0x0000000000605fc2 in FlowHandlePacket (tv=0x7fc6ba5a3b30, fls=0x7fc2fe53b138, p=0x7fc2fe4ff660) at flow.c:512 #3 0x000000000061159a in FlowWorker (tv=0x7fc6ba5a3b30, p=0x7fc2fe4ff660, data=0x7fc2fe53b0f0) at flow-worker.c:502 #4 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba5a3b30, p=0x7fc2fe4ff660, slot=0x7fc6b2c7bd90) at tm-threads.c:117 #5 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba5a3b30, s=0x7fc6b2c7bd90, p=0x7fc2fe4ff660) at ./tm-threads.h:195 #6 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc307fff680, pbd=0x7fbc0fe00000, ppd=0x7fbc0fe1dc08) at source-af-packet.c:983 #7 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc307fff680, pbd=0x7fbc0fe00000) at source-af-packet.c:996 #8 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc307fff680) at source-af-packet.c:1043 #9 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba5a3b30, data=0x7fc307fff680, slot=0x7fc6a3805460) at source-af-packet.c:1393 #10 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba5a3b30) at tm-threads.c:312 #11 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #12 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 3 (Thread 0x7fc4f3fff700 (LWP 58642)): #0 0x00007fc8306685ba in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007fc83066ac25 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x00007fc83075552a in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #3 0x00007fc83065947b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #4 0x0000000000523e86 in SCHSSearch (mpm_ctx=0x7fc699966b30, mpm_thread_ctx=0x7fc4db882828, pmq=0x7fc4db882858, buf=0x7fbf656876a0 , buflen=1180) at util-mpm-hs.c:946 #5 0x00000000005a23e8 in PrefilterPktPayload (det_ctx=0x7fc4db882740, p=0x7fc4e64ff660, pectx=0x7fc699966b30) at detect-engine-payload.c:122 #6 0x00000000005a5b4c in Prefilter (det_ctx=0x7fc4db882740, sgh=0x7fc699674880, p=0x7fc4e64ff660, flags=4 '\004') at detect-engine-prefilter.c:182 #7 0x00000000006f2620 in DetectRunPrefilterPkt (tv=0x7fc6aa071a50, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc4db882740, p=0x7fc4e64ff660, scratch=0x7fc4f3ffe6f0) at detect.c:686 #8 0x00000000006f1d01 in DetectRun (th_v=0x7fc6aa071a50, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc4db882740, p=0x7fc4e64ff660) at detect.c:132 #9 0x00000000006f19ff in DetectFlow (tv=0x7fc6aa071a50, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc4db882740, p=0x7fc4e64ff660) at detect.c:1681 #10 0x00000000006f18a8 in Detect (tv=0x7fc6aa071a50, p=0x7fc4e64ff660, data=0x7fc4db882740) at detect.c:1753 #11 0x0000000000611758 in FlowWorker (tv=0x7fc6aa071a50, p=0x7fc4e64ff660, data=0x7fc4e653b0f0) at flow-worker.c:552 #12 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6aa071a50, p=0x7fc4e64ff660, slot=0x7fc6b4cd3680) at tm-threads.c:117 #13 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6aa071a50, s=0x7fc6b4cd3680, p=0x7fc4e64ff660) at ./tm-threads.h:195 #14 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc4ebfff680, pbd=0x7fbf65600000, ppd=0x7fbf65687620) at source-af-packet.c:983 #15 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc4ebfff680, pbd=0x7fbf65600000) at source-af-packet.c:996 #16 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc4ebfff680) at source-af-packet.c:1043 #17 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6aa071a50, data=0x7fc4ebfff680, slot=0x7fc6aecb2040) at source-af-packet.c:1393 #18 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6aa071a50) at tm-threads.c:312 #19 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #20 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 2 (Thread 0x7fc2924e7700 (LWP 58680)): #0 0x00000000006f4307 in DetectPrefilterMergeSort (de_ctx=0x7fc6bce66f30, det_ctx=0x7fc25b882740) at detect.c:351 #1 0x00000000006f264f in DetectRunPrefilterPkt (tv=0x7fc6ba64b240, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc25b882740, p=0x7fc2664ff660, scratch=0x7fc2924e66f0) at detect.c:695 #2 0x00000000006f1d01 in DetectRun (th_v=0x7fc6ba64b240, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc25b882740, p=0x7fc2664ff660) at detect.c:132 #3 0x00000000006f19ff in DetectFlow (tv=0x7fc6ba64b240, de_ctx=0x7fc6bce66f30, det_ctx=0x7fc25b882740, p=0x7fc2664ff660) at detect.c:1681 #4 0x00000000006f18a8 in Detect (tv=0x7fc6ba64b240, p=0x7fc2664ff660, data=0x7fc25b882740) at detect.c:1753 #5 0x0000000000611758 in FlowWorker (tv=0x7fc6ba64b240, p=0x7fc2664ff660, data=0x7fc26653b0f0) at flow-worker.c:552 #6 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6ba64b240, p=0x7fc2664ff660, slot=0x7fc6b49b9870) at tm-threads.c:117 #7 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6ba64b240, s=0x7fc6b49b9870, p=0x7fc2664ff660) at ./tm-threads.h:195 #8 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc26ffff680, pbd=0x7fbb25200000, ppd=0x7fbb25312c40) at source-af-packet.c:983 #9 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc26ffff680, pbd=0x7fbb25200000) at source-af-packet.c:996 #10 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc26ffff680) at source-af-packet.c:1043 #11 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6ba64b240, data=0x7fc26ffff680, slot=0x7fc6ae2348d0) at source-af-packet.c:1393 #12 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6ba64b240) at tm-threads.c:312 #13 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 1 (Thread 0x7fc49fa74700 (LWP 58647)): #0 0x000000000054b9a5 in HttpRangeClose (c=0x7fb10797f120, flags=0) at app-layer-htp-range.c:530 #1 0x00000000005488a2 in HTPFileCloseHandleRange (files=0x7fb3cfaffec0, flags=0, c=0x7fb10797f120, data=0x0, data_len=0) at app-layer-htp-file.c:360 #2 0x0000000000548a20 in HTPFileClose (s=0x7fb1f884a290, data=0x0, data_len=0, flags=0 '\000', direction=8 '\b') at app-layer-htp-file.c:418 #3 0x000000000054473e in HTPCallbackResponseComplete (tx=0x7fb1fa34d360) at app-layer-htp.c:2255 #4 0x00007fc830bdeb61 in htp_hook_run_all (hook=0x1c5b340, user_data=0x7fb1fa34d360) at htp_hooks.c:127 #5 0x00007fc830be711b in htp_tx_state_response_complete_ex (tx=0x7fb1fa34d360, hybrid_mode=0) at htp_transaction.c:1219 #6 0x00007fc830be493a in htp_connp_res_data (connp=0x7faea5759050, timestamp=, data=, len=) at htp_response.c:1321 #7 0x0000000000543281 in HTPHandleResponseData (f=0x7fb483265450, htp_state=0x7fb1f884a290, pstate=0x7fb2a31837a0, stream_slice=..., local_data=0x0) at app-layer-htp.c:942 #8 0x000000000054f1fe in AppLayerParserParse (tv=0x7fc6baa60690, alp_tctx=0x7fc49259db30, f=0x7fb483265450, alproto=1, flags=26 '\032', input=0x0, input_len=6516) at app-layer-parser.c:1304 #9 0x000000000053506c in AppLayerHandleTCPData (tv=0x7fc6baa60690, ra_ctx=0x7fc492573c30, p=0x7fc4924fec10, f=0x7fb483265450, ssn=0x7fb5a6e02500, stream=0x7fc49fa734f0, data=0x0, data_len=6516, flags=26 '\032') at app-layer.c:633 #10 0x000000000067b54f in ReassembleUpdateAppLayer (tv=0x7fc6baa60690, ra_ctx=0x7fc492573c30, ssn=0x7fb5a6e02500, stream=0x7fc49fa734f0, p=0x7fc4924fec10, dir=UPDATE_DIR_PACKET) at stream-tcp-reassemble.c:1133 #11 0x000000000067b240 in StreamTcpReassembleAppLayer (tv=0x7fc6baa60690, ra_ctx=0x7fc492573c30, ssn=0x7fb5a6e02500, stream=0x7fb5a6e02510, p=0x7fc4924fec10, dir=UPDATE_DIR_PACKET) at stream-tcp-reassemble.c:1264 #12 0x000000000067cf60 in StreamTcpReassembleHandleSegment (tv=0x7fc6baa60690, ra_ctx=0x7fc492573c30, ssn=0x7fb5a6e02500, stream=0x7fb5a6e02510, p=0x7fc4924fec10, pq=0x7fc49253b120) at stream-tcp-reassemble.c:1930 #13 0x00000000006617d2 in StreamTcpPacket (tv=0x7fc6baa60690, p=0x7fc4924fec10, stt=0x7fc497fffc70, pq=0x7fc49253b120) at stream-tcp.c:4936 #14 0x0000000000664136 in StreamTcp (tv=0x7fc6baa60690, p=0x7fc4924fec10, data=0x7fc497fffc70, pq=0x7fc49253b120) at stream-tcp.c:5312 #15 0x0000000000611bb3 in FlowWorkerStreamTCPUpdate (tv=0x7fc6baa60690, fw=0x7fc49253b0f0, p=0x7fc4924fec10, detect_thread=0x7fc487882740, timeout=true) at flow-worker.c:370 #16 0x0000000000612438 in FlowWorkerFlowTimeout (tv=0x7fc6baa60690, p=0x7fc4924fec10, fw=0x7fc49253b0f0, detect_thread=0x7fc487882740) at flow-worker.c:413 #17 0x00000000006123d8 in FlowFinish (tv=0x7fc6baa60690, f=0x7fb483265450, fw=0x7fc49253b0f0, detect_thread=0x7fc487882740) at flow-worker.c:157 #18 0x000000000061208c in CheckWorkQueue (tv=0x7fc6baa60690, fw=0x7fc49253b0f0, detect_thread=0x7fc487882740, counters=0x7fc49fa73768, fq=0x7fc49fa73790) at flow-worker.c:177 #19 0x0000000000611ed9 in FlowWorkerProcessInjectedFlows (tv=0x7fc6baa60690, fw=0x7fc49253b0f0, p=0x7fc4924ff660, detect_thread=0x7fc487882740) at flow-worker.c:460 #20 0x000000000061189b in FlowWorker (tv=0x7fc6baa60690, p=0x7fc4924ff660, data=0x7fc49253b0f0) at flow-worker.c:590 #21 0x0000000000501c84 in TmThreadsSlotVarRun (tv=0x7fc6baa60690, p=0x7fc4924ff660, slot=0x7fc6b9f3f660) at tm-threads.c:117 #22 0x0000000000655a9e in TmThreadsSlotProcessPkt (tv=0x7fc6baa60690, s=0x7fc6b9f3f660, p=0x7fc4924ff660) at ./tm-threads.h:195 #23 0x0000000000655928 in AFPParsePacketV3 (ptv=0x7fc497fff680, pbd=0x7fbed7200000, ppd=0x7fbed7288fd8) at source-af-packet.c:983 #24 0x00000000006555f2 in AFPWalkBlock (ptv=0x7fc497fff680, pbd=0x7fbed7200000) at source-af-packet.c:996 #25 0x000000000065449c in AFPReadFromRingV3 (ptv=0x7fc497fff680) at source-af-packet.c:1043 #26 0x00000000006538f2 in ReceiveAFPLoop (tv=0x7fc6baa60690, data=0x7fc497fff680, slot=0x7fc6b7a20370) at source-af-packet.c:1393 #27 0x0000000000506e3a in TmThreadsSlotPktAcqLoop (td=0x7fc6baa60690) at tm-threads.c:312 #28 0x00007fc830983609 in start_thread (arg=) at pthread_create.c:477 #29 0x00007fc82fdec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 72 (Thread 0x7f103ffff700 (LWP 14078)): #0 0x00007f1638c0dff3 in __GI___pthread_mutex_lock (mutex=0x7f0750ba7648) at ../nptl/pthread_mutex_lock.c:80 #1 0x00000000006113e6 in Recycler (tv=0x7f14c2a14f90, output_thread_data=0x7f1034000b80, f=0x7f0750ba75c0) at flow-manager.c:586 #2 0x000000000061028a in FlowRecycler (th_v=0x7f14c2a14f90, thread_data=0x7f1034000b60) at flow-manager.c:1140 #3 0x0000000000509d76 in TmThreadsManagement (td=0x7f14c2a14f90) at tm-threads.c:552 #4 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #5 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 71 (Thread 0x7f103effd700 (LWP 14080)): #0 futex_abstimed_wait_cancelable (private=, abstime=0x7f103effcb58, clockid=, expected=0, futex_word=0x7f14a1caa5f8) at ../sysdeps/nptl/futex-internal.h:320 #1 __pthread_cond_wait_common (abstime=0x7f103effcb58, clockid=, mutex=0x7f14a20116c0, cond=0x7f14a1caa5d0) at pthread_cond_wait.c:520 #2 __pthread_cond_timedwait (cond=0x7f14a1caa5d0, mutex=0x7f14a20116c0, abstime=0x7f103effcb58) at pthread_cond_wait.c:656 #3 0x0000000000564bdc in StatsWakeupThread (arg=0x7f14c2a38660) at counters.c:487 #4 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #5 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 70 (Thread 0x7f103f7fe700 (LWP 14079)): #0 0x00007f16380323bf in __GI___clock_nanosleep (clock_id=clock_id@entry=0, flags=flags@entry=0, req=req@entry=0x7f103f7fda40, rem=rem@entry=0x0) at ../sysdeps/unix/sysv/linux/clock_nanosleep.c:78 #1 0x00007f1638038047 in __GI___nanosleep (requested_time=requested_time@entry=0x7f103f7fda40, remaining=remaining@entry=0x0) at nanosleep.c:27 #2 0x00007f163806a9bf in usleep (useconds=) at ../sysdeps/posix/usleep.c:32 #3 0x00000000006102d0 in FlowRecycler (th_v=0x7f14c2a1d340, thread_data=0x7f102c000b60) at flow-manager.c:1165 #4 0x0000000000509d76 in TmThreadsManagement (td=0x7f14c2a1d340) at tm-threads.c:552 #5 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #6 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 69 (Thread 0x7f108975b700 (LWP 14076)): #0 0x00007f16380323bf in __GI___clock_nanosleep (clock_id=clock_id@entry=0, flags=flags@entry=0, req=req@entry=0x7f108975a980, rem=rem@entry=0x0) at ../sysdeps/unix/sysv/linux/clock_nanosleep.c:78 #1 0x00007f1638038047 in __GI___nanosleep (requested_time=requested_time@entry=0x7f108975a980, remaining=remaining@entry=0x0) at nanosleep.c:27 #2 0x00007f163806a9bf in usleep (useconds=) at ../sysdeps/posix/usleep.c:32 #3 0x000000000060feb4 in FlowManager (th_v=0x7f14c29ddac0, thread_data=0x7f1054000b60) at flow-manager.c:969 #4 0x0000000000509d76 in TmThreadsManagement (td=0x7f14c29ddac0) at tm-threads.c:552 #5 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #6 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 68 (Thread 0x7f108b273700 (LWP 14074)): #0 JsonAnomalyLogger (tv=0x6f5632 , thread_data=0x7f14c29ba9c0, p=0x7f106e4ff660) at output-json-anomaly.c:278 #1 0x000000000064767a in OutputPacketLog (tv=0x7f14c29ba9c0, p=0x7f106e4ff660, thread_data=0x7f1063d4d620) at output-packet.c:111 #2 0x000000000061d3e5 in OutputLoggerLog (tv=0x7f14c29ba9c0, p=0x7f106e4ff660, thread_data=0x7f1063d4d600) at output.c:885 #3 0x000000000061562d in FlowWorker (tv=0x7f14c29ba9c0, p=0x7f106e4ff660, data=0x7f106e53b0f0) at flow-worker.c:557 #4 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14c29ba9c0, p=0x7f106e4ff660, slot=0x7f14bdde8810) at tm-threads.c:117 #5 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14c29ba9c0, s=0x7f14bdde8810, p=0x7f106e4ff660) at ./tm-threads.h:195 #6 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f1077fff680, pbd=0x7f0923400000, ppd=0x7f09234a88e8) at source-af-packet.c:983 #7 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f1077fff680, pbd=0x7f0923400000) at source-af-packet.c:996 #8 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f1077fff680) at source-af-packet.c:1043 #9 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14c29ba9c0, data=0x7f1077fff680, slot=0x7f14bddf0270) at source-af-packet.c:1393 #10 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14c29ba9c0) at tm-threads.c:312 #11 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #12 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 67 (Thread 0x7f103dffb700 (LWP 14082)): #0 0x00007f163806a12b in __GI___select (nfds=7, readfds=0x7f103dffaa28, writefds=0x0, exceptfds=0x0, timeout=0x7f103dffaab0) at ../sysdeps/unix/sysv/linux/select.c:41 #1 0x000000000050c1d2 in UnixMain (this=0xd25920 ) at unix-manager.c:650 #2 0x000000000050bdec in UnixManager (th_v=0x7f14c27ef7d0, thread_data=0x7f1024000b60) at unix-manager.c:1125 #3 0x0000000000509d76 in TmThreadsManagement (td=0x7f14c27ef7d0) at tm-threads.c:552 #4 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #5 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 66 (Thread 0x7f1253273700 (LWP 14047)): #0 0x0000000000590fa6 in DetectEnginePktInspectionRun (tv=0x7f14af13f980, det_ctx=0x7f122b882740, s=0x7f14c5affc60, f=0x7ef87bc4f9b0, p=0x7f12364ff660, alert_flags=0x7f12532726b7 "") at detect-engine.c:1813 #1 0x00000000006f6656 in DetectRulePacketRules (tv=0x7f14af13f980, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f122b882740, p=0x7f12364ff660, pflow=0x7ef87bc4f9b0, scratch=0x7f1253272730) at detect.c:798 #2 0x00000000006f5a8e in DetectRun (th_v=0x7f14af13f980, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f122b882740, p=0x7f12364ff660) at detect.c:136 #3 0x00000000006f576f in DetectFlow (tv=0x7f14af13f980, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f122b882740, p=0x7f12364ff660) at detect.c:1683 #4 0x00000000006f5618 in Detect (tv=0x7f14af13f980, p=0x7f12364ff660, data=0x7f122b882740) at detect.c:1755 #5 0x0000000000615618 in FlowWorker (tv=0x7f14af13f980, p=0x7f12364ff660, data=0x7f123653b0f0) at flow-worker.c:552 #6 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14af13f980, p=0x7f12364ff660, slot=0x7f14c2ac3a00) at tm-threads.c:117 #7 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14af13f980, s=0x7f14c2ac3a00, p=0x7f12364ff660) at ./tm-threads.h:195 #8 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f123ffff680, pbd=0x7f0c1cc00000, ppd=0x7f0c1cc15280) at source-af-packet.c:983 #9 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f123ffff680, pbd=0x7f0c1cc00000) at source-af-packet.c:996 #10 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f123ffff680) at source-af-packet.c:1043 #11 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14af13f980, data=0x7f123ffff680, slot=0x7f14c081a5b0) at source-af-packet.c:1393 #12 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14af13f980) at tm-threads.c:312 #13 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 65 (Thread 0x7f11b89cf700 (LWP 14059)): #0 0x00007f16388f0569 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007f16388f2c25 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x00007f16389dd52a in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #3 0x00007f16388e147b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #4 0x0000000000526a16 in SCHSSearch (mpm_ctx=0x7f14a25837b0, mpm_thread_ctx=0x7f1163882828, pmq=0x7f1163882858, buf=0x7f0ad7055e8c , buflen=1374) at util-mpm-hs.c:946 #5 0x00000000005a5f06 in PrefilterPktStream (det_ctx=0x7f1163882740, p=0x7f116e4ff660, pectx=0x7f14a25837b0) at detect-engine-payload.c:99 #6 0x00000000005a978c in Prefilter (det_ctx=0x7f1163882740, sgh=0x7f14a23d7f00, p=0x7f116e4ff660, flags=4 '\004') at detect-engine-prefilter.c:182 #7 0x00000000006f63c0 in DetectRunPrefilterPkt (tv=0x7f14a8586850, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1163882740, p=0x7f116e4ff660, scratch=0x7f11b89ce730) at detect.c:688 #8 0x00000000006f5a71 in DetectRun (th_v=0x7f14a8586850, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1163882740, p=0x7f116e4ff660) at detect.c:132 #9 0x00000000006f576f in DetectFlow (tv=0x7f14a8586850, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1163882740, p=0x7f116e4ff660) at detect.c:1683 #10 0x00000000006f5618 in Detect (tv=0x7f14a8586850, p=0x7f116e4ff660, data=0x7f1163882740) at detect.c:1755 #11 0x0000000000615618 in FlowWorker (tv=0x7f14a8586850, p=0x7f116e4ff660, data=0x7f116e53b0f0) at flow-worker.c:552 #12 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14a8586850, p=0x7f116e4ff660, slot=0x7f14c2c658a0) at tm-threads.c:117 #13 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14a8586850, s=0x7f14c2c658a0, p=0x7f116e4ff660) at ./tm-threads.h:195 #14 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f1177fff680, pbd=0x7f0ad7000000, ppd=0x7f0ad7055df0) at source-af-packet.c:983 #15 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f1177fff680, pbd=0x7f0ad7000000) at source-af-packet.c:996 #16 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f1177fff680) at source-af-packet.c:1043 #17 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14a8586850, data=0x7f1177fff680, slot=0x7f14a8de8b90) at source-af-packet.c:1393 #18 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14a8586850) at tm-threads.c:312 #19 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #20 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 64 (Thread 0x7f103e7fc700 (LWP 14081)): #0 futex_abstimed_wait_cancelable (private=, abstime=0x7f103e7fbb48, clockid=, expected=0, futex_word=0x7f14a20110b8) at ../sysdeps/nptl/futex-internal.h:320 #1 __pthread_cond_wait_common (abstime=0x7f103e7fbb48, clockid=, mutex=0x7f1497b30fa0, cond=0x7f14a2011090) at pthread_cond_wait.c:520 #2 __pthread_cond_timedwait (cond=0x7f14a2011090, mutex=0x7f1497b30fa0, abstime=0x7f103e7fbb48) at pthread_cond_wait.c:656 #3 0x0000000000565056 in StatsMgmtThread (arg=0x7f14c0c48c10) at counters.c:415 #4 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #5 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 63 (Thread 0x7f11224e7700 (LWP 14066)): #0 0x00000000006f7d19 in DetectPrefilterBuildNonPrefilterList (det_ctx=0x7f10eb882740, mask=131 '\203', alproto=34 '"') at detect.c:383 #1 0x00000000006f63a3 in DetectRunPrefilterPkt (tv=0x7f14c2b0fbf0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f10eb882740, p=0x7f10f64ff660, scratch=0x7f11224e6730) at detect.c:683 #2 0x00000000006f5a71 in DetectRun (th_v=0x7f14c2b0fbf0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f10eb882740, p=0x7f10f64ff660) at detect.c:132 #3 0x00000000006f576f in DetectFlow (tv=0x7f14c2b0fbf0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f10eb882740, p=0x7f10f64ff660) at detect.c:1683 #4 0x00000000006f5618 in Detect (tv=0x7f14c2b0fbf0, p=0x7f10f64ff660, data=0x7f10eb882740) at detect.c:1755 #5 0x0000000000615618 in FlowWorker (tv=0x7f14c2b0fbf0, p=0x7f10f64ff660, data=0x7f10f653b0f0) at flow-worker.c:552 #6 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14c2b0fbf0, p=0x7f10f64ff660, slot=0x7f14c0dfd4f0) at tm-threads.c:117 #7 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14c2b0fbf0, s=0x7f14c0dfd4f0, p=0x7f10f64ff660) at ./tm-threads.h:195 #8 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f10fffff680, pbd=0x7f0a11000000, ppd=0x7f0a11004d58) at source-af-packet.c:983 #9 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f10fffff680, pbd=0x7f0a11000000) at source-af-packet.c:996 #10 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f10fffff680) at source-af-packet.c:1043 #11 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14c2b0fbf0, data=0x7f10fffff680, slot=0x7f14ac5f11f0) at source-af-packet.c:1393 #12 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14c2b0fbf0) at tm-threads.c:312 #13 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 62 (Thread 0x7f12524e7700 (LWP 14048)): #0 0x00007f16389a5eee in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007f16389dd5a5 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x00007f16388e147b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #3 0x0000000000526a16 in SCHSSearch (mpm_ctx=0x7f14a237d770, mpm_thread_ctx=0x7f121b882828, pmq=0x7f121b882858, buf=0x7f0c1287ef74 , buflen=1147) at util-mpm-hs.c:946 #4 0x00000000005a6008 in PrefilterPktPayload (det_ctx=0x7f121b882740, p=0x7f12264ff660, pectx=0x7f14a237d770) at detect-engine-payload.c:122 #5 0x00000000005a978c in Prefilter (det_ctx=0x7f121b882740, sgh=0x7f14a1f7a840, p=0x7f12264ff660, flags=4 '\004') at detect-engine-prefilter.c:182 #6 0x00000000006f63c0 in DetectRunPrefilterPkt (tv=0x7f14bec1e940, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f121b882740, p=0x7f12264ff660, scratch=0x7f12524e6730) at detect.c:688 #7 0x00000000006f5a71 in DetectRun (th_v=0x7f14bec1e940, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f121b882740, p=0x7f12264ff660) at detect.c:132 #8 0x00000000006f576f in DetectFlow (tv=0x7f14bec1e940, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f121b882740, p=0x7f12264ff660) at detect.c:1683 #9 0x00000000006f5618 in Detect (tv=0x7f14bec1e940, p=0x7f12264ff660, data=0x7f121b882740) at detect.c:1755 #10 0x0000000000615618 in FlowWorker (tv=0x7f14bec1e940, p=0x7f12264ff660, data=0x7f122653b0f0) at flow-worker.c:552 #11 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14bec1e940, p=0x7f12264ff660, slot=0x7f14c4c0c630) at tm-threads.c:117 #12 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14bec1e940, s=0x7f14c4c0c630, p=0x7f12264ff660) at ./tm-threads.h:195 #13 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f122ffff680, pbd=0x7f0c12800000, ppd=0x7f0c1287eef0) at source-af-packet.c:983 #14 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f122ffff680, pbd=0x7f0c12800000) at source-af-packet.c:996 #15 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f122ffff680) at source-af-packet.c:1043 #16 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14bec1e940, data=0x7f122ffff680, slot=0x7f14c4c23150) at source-af-packet.c:1393 #17 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14bec1e940) at tm-threads.c:312 #18 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #19 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 61 (Thread 0x7f11b975b700 (LWP 14058)): #0 0x00000000006f83e2 in DetectRunInspectRuleHeader (p=0x7f117e4ff660, f=0x7ef0bb57b9a0, s=0x7f14c5b3f1d0, sflags=1572879, s_proto_flags=1 '\001') at detect.c:609 #1 0x00000000006f662b in DetectRulePacketRules (tv=0x7f14c2c9b740, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1173882740, p=0x7f117e4ff660, pflow=0x7ef0bb57b9a0, scratch=0x7f11b975a730) at detect.c:794 #2 0x00000000006f5a8e in DetectRun (th_v=0x7f14c2c9b740, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1173882740, p=0x7f117e4ff660) at detect.c:136 #3 0x00000000006f576f in DetectFlow (tv=0x7f14c2c9b740, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1173882740, p=0x7f117e4ff660) at detect.c:1683 #4 0x00000000006f5618 in Detect (tv=0x7f14c2c9b740, p=0x7f117e4ff660, data=0x7f1173882740) at detect.c:1755 #5 0x0000000000615618 in FlowWorker (tv=0x7f14c2c9b740, p=0x7f117e4ff660, data=0x7f117e53b0f0) at flow-worker.c:552 #6 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14c2c9b740, p=0x7f117e4ff660, slot=0x7f14bcb58500) at tm-threads.c:117 #7 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14c2c9b740, s=0x7f14bcb58500, p=0x7f117e4ff660) at ./tm-threads.h:195 #8 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f1187fff680, pbd=0x7f0af5e00000, ppd=0x7f0af5e598d0) at source-af-packet.c:983 #9 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f1187fff680, pbd=0x7f0af5e00000) at source-af-packet.c:996 #10 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f1187fff680) at source-af-packet.c:1043 #11 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14c2c9b740, data=0x7f1187fff680, slot=0x7f14bcb76ef0) at source-af-packet.c:1393 #12 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14c2c9b740) at tm-threads.c:312 #13 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 60 (Thread 0x7f11bbfff700 (LWP 14055)): #0 0x00000000006590ad in AFPParsePacketV3 (ptv=0x7f11b3fff680, pbd=0x7f0b3ca00000, ppd=0x7f0b3ca0b750) at source-af-packet.c:947 #1 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f11b3fff680, pbd=0x7f0b3ca00000) at source-af-packet.c:996 #2 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f11b3fff680) at source-af-packet.c:1043 #3 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14c2c74180, data=0x7f11b3fff680, slot=0x7f14c0a8f340) at source-af-packet.c:1393 #4 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14c2c74180) at tm-threads.c:312 #5 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #6 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 59 (Thread 0x7f10cd1d0700 (LWP 14072)): #0 0x00000000006f64d5 in DetectRulePacketRules (tv=0x7f14c29834c0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1087882740, p=0x7f10924ff660, pflow=0x7f06bbd6ef00, scratch=0x7f10cd1cf730) at detect.c:756 #1 0x00000000006f5a8e in DetectRun (th_v=0x7f14c29834c0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1087882740, p=0x7f10924ff660) at detect.c:136 #2 0x00000000006f576f in DetectFlow (tv=0x7f14c29834c0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1087882740, p=0x7f10924ff660) at detect.c:1683 #3 0x00000000006f5618 in Detect (tv=0x7f14c29834c0, p=0x7f10924ff660, data=0x7f1087882740) at detect.c:1755 #4 0x0000000000615618 in FlowWorker (tv=0x7f14c29834c0, p=0x7f10924ff660, data=0x7f109253b0f0) at flow-worker.c:552 #5 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14c29834c0, p=0x7f10924ff660, slot=0x7f14b11f4a60) at tm-threads.c:117 #6 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14c29834c0, s=0x7f14b11f4a60, p=0x7f10924ff660) at ./tm-threads.h:195 #7 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f109bfff680, pbd=0x7f0956800000, ppd=0x7f0956873ec8) at source-af-packet.c:983 #8 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f109bfff680, pbd=0x7f0956800000) at source-af-packet.c:996 #9 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f109bfff680) at source-af-packet.c:1043 #10 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14c29834c0, data=0x7f109bfff680, slot=0x7f14c056e330) at source-af-packet.c:1393 #11 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14c29834c0) at tm-threads.c:312 #12 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #13 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 58 (Thread 0x7f145ece8700 (LWP 14015)): #0 0x00007f16389a5eee in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007f16389dd5a5 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x00007f16388e147b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #3 0x0000000000526a16 in SCHSSearch (mpm_ctx=0x7f14a23d2bf0, mpm_thread_ctx=0x7f1437882828, pmq=0x7f1437882858, buf=0x7f0fa4016040 , buflen=83) at util-mpm-hs.c:946 #4 0x00000000005a6008 in PrefilterPktPayload (det_ctx=0x7f1437882740, p=0x7f14424ff660, pectx=0x7f14a23d2bf0) at detect-engine-payload.c:122 #5 0x00000000005a978c in Prefilter (det_ctx=0x7f1437882740, sgh=0x7f14a23d7f00, p=0x7f14424ff660, flags=4 '\004') at detect-engine-prefilter.c:182 #6 0x00000000006f63c0 in DetectRunPrefilterPkt (tv=0x7f14a1fe72f0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1437882740, p=0x7f14424ff660, scratch=0x7f145ece7730) at detect.c:688 #7 0x00000000006f5a71 in DetectRun (th_v=0x7f14a1fe72f0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1437882740, p=0x7f14424ff660) at detect.c:132 #8 0x00000000006f576f in DetectFlow (tv=0x7f14a1fe72f0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1437882740, p=0x7f14424ff660) at detect.c:1683 #9 0x00000000006f5618 in Detect (tv=0x7f14a1fe72f0, p=0x7f14424ff660, data=0x7f1437882740) at detect.c:1755 #10 0x0000000000615618 in FlowWorker (tv=0x7f14a1fe72f0, p=0x7f14424ff660, data=0x7f144253b0f0) at flow-worker.c:552 #11 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14a1fe72f0, p=0x7f14424ff660, slot=0x7f14b682e440) at tm-threads.c:117 #12 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14a1fe72f0, s=0x7f14b682e440, p=0x7f14424ff660) at ./tm-threads.h:195 #13 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f144bfff680, pbd=0x7f0fa4000000, ppd=0x7f0fa4015fb0) at source-af-packet.c:983 #14 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f144bfff680, pbd=0x7f0fa4000000) at source-af-packet.c:996 #15 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f144bfff680) at source-af-packet.c:1043 #16 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14a1fe72f0, data=0x7f144bfff680, slot=0x7f14c01b1940) at source-af-packet.c:1393 #17 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14a1fe72f0) at tm-threads.c:312 #18 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #19 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 57 (Thread 0x7f125175b700 (LWP 14049)): #0 0x000000000056d8d5 in DecodeEthernet (tv=0x7f14c2e66780, dtv=0x7f121ffffcc0, p=0x7f12164ff660, pkt=0x7f0bf5c4ce06 , len=1393) at decode-ethernet.c:61 #1 0x000000000065cdd3 in DecodeLinkLayer (tv=0x7f14c2e66780, dtv=0x7f121ffffcc0, datalink=1, p=0x7f12164ff660, data=0x7f0bf5c4ce06 , len=1393) at ./decode.h:1266 #2 0x0000000000657a13 in DecodeAFP (tv=0x7f14c2e66780, p=0x7f12164ff660, data=0x7f121ffffcc0) at source-af-packet.c:2710 #3 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14c2e66780, p=0x7f12164ff660, slot=0x7f14c090d070) at tm-threads.c:117 #4 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14c2e66780, s=0x7f14c090d070, p=0x7f12164ff660) at ./tm-threads.h:195 #5 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f121ffff680, pbd=0x7f0bf5c00000, ppd=0x7f0bf5c4cdb0) at source-af-packet.c:983 #6 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f121ffff680, pbd=0x7f0bf5c00000) at source-af-packet.c:996 #7 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f121ffff680) at source-af-packet.c:1043 #8 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14c2e66780, data=0x7f121ffff680, slot=0x7f14b8c808c0) at source-af-packet.c:1393 #9 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14c2e66780) at tm-threads.c:312 #10 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #11 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 56 (Thread 0x7f112175b700 (LWP 14067)): #0 0x000000000056420e in StatsIncr (tv=0x7f14c2b20250, id=16) at counters.c:179 #1 0x000000000056d7ed in DecodeEthernet (tv=0x7f14c2b20250, dtv=0x7f10effffcc0, p=0x7f10e64ff660, pkt=0x7f09e4c6166e , len=209) at decode-ethernet.c:47 #2 0x000000000065cdd3 in DecodeLinkLayer (tv=0x7f14c2b20250, dtv=0x7f10effffcc0, datalink=1, p=0x7f10e64ff660, data=0x7f09e4c6166e , len=209) at ./decode.h:1266 #3 0x0000000000657a13 in DecodeAFP (tv=0x7f14c2b20250, p=0x7f10e64ff660, data=0x7f10effffcc0) at source-af-packet.c:2710 #4 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14c2b20250, p=0x7f10e64ff660, slot=0x7f14bde1f870) at tm-threads.c:117 #5 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14c2b20250, s=0x7f14bde1f870, p=0x7f10e64ff660) at ./tm-threads.h:195 #6 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f10effff680, pbd=0x7f09e4c00000, ppd=0x7f09e4c61618) at source-af-packet.c:983 #7 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f10effff680, pbd=0x7f09e4c00000) at source-af-packet.c:996 #8 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f10effff680) at source-af-packet.c:1043 #9 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14c2b20250, data=0x7f10effff680, slot=0x7f14c2e24fc0) at source-af-packet.c:1393 #10 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14c2b20250) at tm-threads.c:312 #11 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #12 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 55 (Thread 0x7f11bb273700 (LWP 14056)): #0 0x00000000005bc190 in DetectFlowMatch (det_ctx=0x7f1193882740, p=0x7f119e4ff660, s=0x7f1193882a00, ctx=0xc5b3d7e0) at detect-flow.c:140 #1 0x00000000005913d8 in DetectEngineInspectRulePacketMatches (det_ctx=0x7f1193882740, engine=0x7f14be362710, s=0x7f14c5ae7200, p=0x7f119e4ff660, _alert_flags=0x7f11bb2726b7 "") at detect-engine.c:1747 #2 0x0000000000590f98 in DetectEnginePktInspectionRun (tv=0x7f14c2c80d80, det_ctx=0x7f1193882740, s=0x7f14c5ae7200, f=0x7f0781ea0620, p=0x7f119e4ff660, alert_flags=0x7f11bb2726b7 "") at detect-engine.c:1812 #3 0x00000000006f6656 in DetectRulePacketRules (tv=0x7f14c2c80d80, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1193882740, p=0x7f119e4ff660, pflow=0x7f0781ea0620, scratch=0x7f11bb272730) at detect.c:798 #4 0x00000000006f5a8e in DetectRun (th_v=0x7f14c2c80d80, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1193882740, p=0x7f119e4ff660) at detect.c:136 #5 0x00000000006f576f in DetectFlow (tv=0x7f14c2c80d80, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1193882740, p=0x7f119e4ff660) at detect.c:1683 #6 0x00000000006f5618 in Detect (tv=0x7f14c2c80d80, p=0x7f119e4ff660, data=0x7f1193882740) at detect.c:1755 #7 0x0000000000615618 in FlowWorker (tv=0x7f14c2c80d80, p=0x7f119e4ff660, data=0x7f119e53b0f0) at flow-worker.c:552 #8 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14c2c80d80, p=0x7f119e4ff660, slot=0x7f14a7c16b20) at tm-threads.c:117 #9 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14c2c80d80, s=0x7f14a7c16b20, p=0x7f119e4ff660) at ./tm-threads.h:195 #10 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f11a7fff680, pbd=0x7f0b25a00000, ppd=0x7f0b25aadfe0) at source-af-packet.c:983 #11 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f11a7fff680, pbd=0x7f0b25a00000) at source-af-packet.c:996 #12 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f11a7fff680) at source-af-packet.c:1043 #13 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14c2c80d80, data=0x7f11a7fff680, slot=0x7f14c0a80570) at source-af-packet.c:1393 #14 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14c2c80d80) at tm-threads.c:312 #15 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #16 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 54 (Thread 0x7f13c51d0700 (LWP 14026)): #0 DetectReplaceFree (det_ctx=0x7f137f882740) at ./detect-replace.h:35 #1 0x00000000006f66b4 in DetectRulePacketRules (tv=0x7f14c2f61bd0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f137f882740, p=0x7f138a4ff660, pflow=0x7f04be77b500, scratch=0x7f13c51cf730) at detect.c:810 #2 0x00000000006f5a8e in DetectRun (th_v=0x7f14c2f61bd0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f137f882740, p=0x7f138a4ff660) at detect.c:136 #3 0x00000000006f576f in DetectFlow (tv=0x7f14c2f61bd0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f137f882740, p=0x7f138a4ff660) at detect.c:1683 #4 0x00000000006f5618 in Detect (tv=0x7f14c2f61bd0, p=0x7f138a4ff660, data=0x7f137f882740) at detect.c:1755 #5 0x0000000000615618 in FlowWorker (tv=0x7f14c2f61bd0, p=0x7f138a4ff660, data=0x7f138a53b0f0) at flow-worker.c:552 #6 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14c2f61bd0, p=0x7f138a4ff660, slot=0x7f14bef53770) at tm-threads.c:117 #7 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14c2f61bd0, s=0x7f14bef53770, p=0x7f138a4ff660) at ./tm-threads.h:195 #8 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f1393fff680, pbd=0x7f0e69c00000, ppd=0x7f0e69ca2858) at source-af-packet.c:983 #9 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f1393fff680, pbd=0x7f0e69c00000) at source-af-packet.c:996 #10 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f1393fff680) at source-af-packet.c:1043 #11 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14c2f61bd0, data=0x7f1393fff680, slot=0x7f14a8cd7fb0) at source-af-packet.c:1393 #12 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14c2f61bd0) at tm-threads.c:312 #13 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 53 (Thread 0x7f148d824700 (LWP 14012)): #0 0x0000000000587b7f in PacketCreateMask (p=0x7f14764ff660, mask=0x7f148d823740 "\201", alproto=34, app_decoder_events=false) at detect-engine-build.c:425 #1 0x00000000006f634f in DetectRunPrefilterPkt (tv=0x7f14a2256910, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f146b882760, p=0x7f14764ff660, scratch=0x7f148d823730) at detect.c:677 #2 0x00000000006f5a71 in DetectRun (th_v=0x7f14a2256910, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f146b882760, p=0x7f14764ff660) at detect.c:132 #3 0x00000000006f576f in DetectFlow (tv=0x7f14a2256910, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f146b882760, p=0x7f14764ff660) at detect.c:1683 #4 0x00000000006f5618 in Detect (tv=0x7f14a2256910, p=0x7f14764ff660, data=0x7f146b882760) at detect.c:1755 #5 0x0000000000615618 in FlowWorker (tv=0x7f14a2256910, p=0x7f14764ff660, data=0x7f147653b0f0) at flow-worker.c:552 #6 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14a2256910, p=0x7f14764ff660, slot=0x7f14a1fd2cf0) at tm-threads.c:117 #7 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14a2256910, s=0x7f14a1fd2cf0, p=0x7f14764ff660) at ./tm-threads.h:195 #8 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f147ffff680, pbd=0x7f0ffd800000, ppd=0x7f0ffd8c1ad0) at source-af-packet.c:983 #9 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f147ffff680, pbd=0x7f0ffd800000) at source-af-packet.c:996 #10 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f147ffff680) at source-af-packet.c:1043 #11 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14a2256910, data=0x7f147ffff680, slot=0x7f14950f2820) at source-af-packet.c:1393 #12 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14a2256910) at tm-threads.c:312 #13 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 52 (Thread 0x7f1166ce8700 (LWP 14061)): #0 0x00007f16389a5eee in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007f16389dd5a5 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x00007f16388e147b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #3 0x0000000000526a16 in SCHSSearch (mpm_ctx=0x7f14a257e580, mpm_thread_ctx=0x7f113f882828, pmq=0x7f113f882858, buf=0x7f0aa293b49c , buflen=988) at util-mpm-hs.c:946 #4 0x00000000005a5f06 in PrefilterPktStream (det_ctx=0x7f113f882740, p=0x7f114a4ff660, pectx=0x7f14a257e580) at detect-engine-payload.c:99 #5 0x00000000005a978c in Prefilter (det_ctx=0x7f113f882740, sgh=0x7f14a21f0290, p=0x7f114a4ff660, flags=8 '\b') at detect-engine-prefilter.c:182 #6 0x00000000006f63c0 in DetectRunPrefilterPkt (tv=0x7f14c2cee2d0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f113f882740, p=0x7f114a4ff660, scratch=0x7f1166ce7730) at detect.c:688 #7 0x00000000006f5a71 in DetectRun (th_v=0x7f14c2cee2d0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f113f882740, p=0x7f114a4ff660) at detect.c:132 #8 0x00000000006f576f in DetectFlow (tv=0x7f14c2cee2d0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f113f882740, p=0x7f114a4ff660) at detect.c:1683 #9 0x00000000006f5618 in Detect (tv=0x7f14c2cee2d0, p=0x7f114a4ff660, data=0x7f113f882740) at detect.c:1755 #10 0x0000000000615618 in FlowWorker (tv=0x7f14c2cee2d0, p=0x7f114a4ff660, data=0x7f114a53b0f0) at flow-worker.c:552 #11 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14c2cee2d0, p=0x7f114a4ff660, slot=0x7f14aef12c60) at tm-threads.c:117 #12 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14c2cee2d0, s=0x7f14aef12c60, p=0x7f114a4ff660) at ./tm-threads.h:195 #13 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f1153fff680, pbd=0x7f0aa2800000, ppd=0x7f0aa293b400) at source-af-packet.c:983 #14 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f1153fff680, pbd=0x7f0aa2800000) at source-af-packet.c:996 #15 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f1153fff680) at source-af-packet.c:1043 #16 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14c2cee2d0, data=0x7f1153fff680, slot=0x7f14c2c43db0) at source-af-packet.c:1393 #17 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14c2cee2d0) at tm-threads.c:312 #18 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #19 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 51 (Thread 0x7f11ffa74700 (LWP 14051)): #0 0x00007f16388e11d8 in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x0000000000526a16 in SCHSSearch (mpm_ctx=0x7f14a237d770, mpm_thread_ctx=0x7f11e7882828, pmq=0x7f11e7882858, buf=0x7f0bb5482868 , buflen=750) at util-mpm-hs.c:946 #2 0x00000000005a6008 in PrefilterPktPayload (det_ctx=0x7f11e7882740, p=0x7f11f24ff660, pectx=0x7f14a237d770) at detect-engine-payload.c:122 #3 0x00000000005a978c in Prefilter (det_ctx=0x7f11e7882740, sgh=0x7f14a2289af0, p=0x7f11f24ff660, flags=4 '\004') at detect-engine-prefilter.c:182 #4 0x00000000006f63c0 in DetectRunPrefilterPkt (tv=0x7f14c2e88440, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f11e7882740, p=0x7f11f24ff660, scratch=0x7f11ffa73730) at detect.c:688 #5 0x00000000006f5a71 in DetectRun (th_v=0x7f14c2e88440, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f11e7882740, p=0x7f11f24ff660) at detect.c:132 #6 0x00000000006f576f in DetectFlow (tv=0x7f14c2e88440, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f11e7882740, p=0x7f11f24ff660) at detect.c:1683 #7 0x00000000006f5618 in Detect (tv=0x7f14c2e88440, p=0x7f11f24ff660, data=0x7f11e7882740) at detect.c:1755 #8 0x0000000000615618 in FlowWorker (tv=0x7f14c2e88440, p=0x7f11f24ff660, data=0x7f11f253b0f0) at flow-worker.c:552 #9 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14c2e88440, p=0x7f11f24ff660, slot=0x7f14c08e7200) at tm-threads.c:117 #10 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14c2e88440, s=0x7f14c08e7200, p=0x7f11f24ff660) at ./tm-threads.h:195 #11 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f11f7fff680, pbd=0x7f0bb5400000, ppd=0x7f0bb54827e8) at source-af-packet.c:983 #12 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f11f7fff680, pbd=0x7f0bb5400000) at source-af-packet.c:996 #13 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f11f7fff680) at source-af-packet.c:1043 #14 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14c2e88440, data=0x7f11f7fff680, slot=0x7f14a3cb30f0) at source-af-packet.c:1393 #15 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14c2e88440) at tm-threads.c:312 #16 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #17 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 50 (Thread 0x7f10cfa74700 (LWP 14069)): #0 0x00000000005913c2 in DetectEngineInspectRulePacketMatches (det_ctx=0x7f10b7882740, engine=0x7f14be2b5b60, s=0x7f14c5b153e0, p=0x7f10c24ff660, _alert_flags=0x7f10cfa736b7 "") at detect-engine.c:1747 #1 0x0000000000590f98 in DetectEnginePktInspectionRun (tv=0x7f14c2b7bac0, det_ctx=0x7f10b7882740, s=0x7f14c5b153e0, f=0x7ef0b9ef1860, p=0x7f10c24ff660, alert_flags=0x7f10cfa736b7 "") at detect-engine.c:1812 #2 0x00000000006f6656 in DetectRulePacketRules (tv=0x7f14c2b7bac0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f10b7882740, p=0x7f10c24ff660, pflow=0x7ef0b9ef1860, scratch=0x7f10cfa73730) at detect.c:798 #3 0x00000000006f5a8e in DetectRun (th_v=0x7f14c2b7bac0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f10b7882740, p=0x7f10c24ff660) at detect.c:136 #4 0x00000000006f576f in DetectFlow (tv=0x7f14c2b7bac0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f10b7882740, p=0x7f10c24ff660) at detect.c:1683 #5 0x00000000006f5618 in Detect (tv=0x7f14c2b7bac0, p=0x7f10c24ff660, data=0x7f10b7882740) at detect.c:1755 #6 0x0000000000615618 in FlowWorker (tv=0x7f14c2b7bac0, p=0x7f10c24ff660, data=0x7f10c253b0f0) at flow-worker.c:552 #7 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14c2b7bac0, p=0x7f10c24ff660, slot=0x7f14c2e007d0) at tm-threads.c:117 #8 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14c2b7bac0, s=0x7f14c2e007d0, p=0x7f10c24ff660) at ./tm-threads.h:195 #9 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f10c7fff680, pbd=0x7f09b5c00000, ppd=0x7f09b5c248c0) at source-af-packet.c:983 #10 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f10c7fff680, pbd=0x7f09b5c00000) at source-af-packet.c:996 #11 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f10c7fff680) at source-af-packet.c:1043 #12 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14c2b7bac0, data=0x7f10c7fff680, slot=0x7f14bddf3ad0) at source-af-packet.c:1393 #13 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14c2b7bac0) at tm-threads.c:312 #14 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #15 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 49 (Thread 0x7f132d1d0700 (LWP 14035)): #0 DetectRunTxInspectRule (tv=0x7f14b5739fe0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f12e7882740, p=0x7f12f24ff660, f=0x7ef2d31cdcd0, in_flow_flags=8 '\b', alstate=0x7f0467f75d50, tx=0x7f132d1cf620, s=0x7f14c5b65090, stored_flags=0x7f12f3ecae58, can=0x7f12e790bf40, scratch=0x7f132d1cf730) at detect.c:1065 #1 0x00000000006f7651 in DetectRunTx (tv=0x7f14b5739fe0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f12e7882740, p=0x7f12f24ff660, f=0x7ef2d31cdcd0, scratch=0x7f132d1cf730) at detect.c:1480 #2 0x00000000006f5b96 in DetectRun (th_v=0x7f14b5739fe0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f12e7882740, p=0x7f12f24ff660) at detect.c:153 #3 0x00000000006f576f in DetectFlow (tv=0x7f14b5739fe0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f12e7882740, p=0x7f12f24ff660) at detect.c:1683 #4 0x00000000006f5618 in Detect (tv=0x7f14b5739fe0, p=0x7f12f24ff660, data=0x7f12e7882740) at detect.c:1755 #5 0x0000000000615618 in FlowWorker (tv=0x7f14b5739fe0, p=0x7f12f24ff660, data=0x7f12f253b0f0) at flow-worker.c:552 #6 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14b5739fe0, p=0x7f12f24ff660, slot=0x7f14bf972f50) at tm-threads.c:117 #7 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14b5739fe0, s=0x7f14bf972f50, p=0x7f12f24ff660) at ./tm-threads.h:195 #8 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f12fbfff680, pbd=0x7f0d58600000, ppd=0x7f0d586e9e48) at source-af-packet.c:983 #9 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f12fbfff680, pbd=0x7f0d58600000) at source-af-packet.c:996 #10 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f12fbfff680) at source-af-packet.c:1043 #11 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14b5739fe0, data=0x7f12fbfff680, slot=0x7f14b78e0080) at source-af-packet.c:1393 #12 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14b5739fe0) at tm-threads.c:312 #13 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 48 (Thread 0x7f1123fff700 (LWP 14064)): #0 0x00000000006f80ed in DetectPrefilterMergeSort (de_ctx=0x7f14c5c7fe50, det_ctx=0x7f110b882740) at detect.c:358 #1 0x00000000006f63ef in DetectRunPrefilterPkt (tv=0x7f14c2adb7c0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f110b882740, p=0x7f11164ff660, scratch=0x7f1123ffe730) at detect.c:697 #2 0x00000000006f5a71 in DetectRun (th_v=0x7f14c2adb7c0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f110b882740, p=0x7f11164ff660) at detect.c:132 #3 0x00000000006f576f in DetectFlow (tv=0x7f14c2adb7c0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f110b882740, p=0x7f11164ff660) at detect.c:1683 #4 0x00000000006f5618 in Detect (tv=0x7f14c2adb7c0, p=0x7f11164ff660, data=0x7f110b882740) at detect.c:1755 #5 0x0000000000615618 in FlowWorker (tv=0x7f14c2adb7c0, p=0x7f11164ff660, data=0x7f111653b0f0) at flow-worker.c:552 #6 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14c2adb7c0, p=0x7f11164ff660, slot=0x7f14b6ee54a0) at tm-threads.c:117 #7 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14c2adb7c0, s=0x7f14b6ee54a0, p=0x7f11164ff660) at ./tm-threads.h:195 #8 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f111bfff680, pbd=0x7f0a30800000, ppd=0x7f0a308a2130) at source-af-packet.c:983 #9 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f111bfff680, pbd=0x7f0a30800000) at source-af-packet.c:996 #10 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f111bfff680) at source-af-packet.c:1043 #11 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14c2adb7c0, data=0x7f111bfff680, slot=0x7f14a7ac7360) at source-af-packet.c:1393 #12 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14c2adb7c0) at tm-threads.c:312 #13 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 47 (Thread 0x7f141b273700 (LWP 14019)): #0 DetectProtoContainsProto (dp=0x7f13fe4ff660, proto=32532) at detect-engine-proto.c:136 #1 0x00000000006f845c in DetectRunInspectRuleHeader (p=0x7f13fe4ff660, f=0x7f14c8d56fc0, s=0x7f14c5b3f1d0, sflags=1572879, s_proto_flags=1 '\001') at detect.c:609 #2 0x00000000006f662b in DetectRulePacketRules (tv=0x7f14bdd81b80, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f13f3882740, p=0x7f13fe4ff660, pflow=0x7f14c8d56fc0, scratch=0x7f141b272730) at detect.c:794 #3 0x00000000006f5a8e in DetectRun (th_v=0x7f14bdd81b80, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f13f3882740, p=0x7f13fe4ff660) at detect.c:136 #4 0x00000000006f576f in DetectFlow (tv=0x7f14bdd81b80, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f13f3882740, p=0x7f13fe4ff660) at detect.c:1683 #5 0x00000000006f5618 in Detect (tv=0x7f14bdd81b80, p=0x7f13fe4ff660, data=0x7f13f3882740) at detect.c:1755 #6 0x0000000000615618 in FlowWorker (tv=0x7f14bdd81b80, p=0x7f13fe4ff660, data=0x7f13fe53b0f0) at flow-worker.c:552 #7 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14bdd81b80, p=0x7f13fe4ff660, slot=0x7f14b12b58f0) at tm-threads.c:117 #8 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14bdd81b80, s=0x7f14b12b58f0, p=0x7f13fe4ff660) at ./tm-threads.h:195 #9 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f1407fff680, pbd=0x7f0f35000000, ppd=0x7f0f35077f08) at source-af-packet.c:983 #10 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f1407fff680, pbd=0x7f0f35000000) at source-af-packet.c:996 #11 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f1407fff680) at source-af-packet.c:1043 #12 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14bdd81b80, data=0x7f1407fff680, slot=0x7f14b12959c0) at source-af-packet.c:1393 #13 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14bdd81b80) at tm-threads.c:312 #14 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #15 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 46 (Thread 0x7f12ebfff700 (LWP 14036)): #0 0x00007f16388f0478 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007f16388f2c25 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x00007f16389dd52a in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #3 0x00007f16388e147b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #4 0x0000000000526a16 in SCHSSearch (mpm_ctx=0x7f14a237d770, mpm_thread_ctx=0x7f12d3882828, pmq=0x7f12d3882858, buf=0x7f0d50845468 , buflen=627) at util-mpm-hs.c:946 #5 0x00000000005a6008 in PrefilterPktPayload (det_ctx=0x7f12d3882740, p=0x7f12de4ff660, pectx=0x7f14a237d770) at detect-engine-payload.c:122 #6 0x00000000005a978c in Prefilter (det_ctx=0x7f12d3882740, sgh=0x7f14a1f7a840, p=0x7f12de4ff660, flags=4 '\004') at detect-engine-prefilter.c:182 #7 0x00000000006f63c0 in DetectRunPrefilterPkt (tv=0x7f14b65532d0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f12d3882740, p=0x7f12de4ff660, scratch=0x7f12ebffe730) at detect.c:688 #8 0x00000000006f5a71 in DetectRun (th_v=0x7f14b65532d0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f12d3882740, p=0x7f12de4ff660) at detect.c:132 #9 0x00000000006f576f in DetectFlow (tv=0x7f14b65532d0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f12d3882740, p=0x7f12de4ff660) at detect.c:1683 #10 0x00000000006f5618 in Detect (tv=0x7f14b65532d0, p=0x7f12de4ff660, data=0x7f12d3882740) at detect.c:1755 #11 0x0000000000615618 in FlowWorker (tv=0x7f14b65532d0, p=0x7f12de4ff660, data=0x7f12de53b0f0) at flow-worker.c:552 #12 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14b65532d0, p=0x7f12de4ff660, slot=0x7f14c2b70b30) at tm-threads.c:117 #13 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14b65532d0, s=0x7f14c2b70b30, p=0x7f12de4ff660) at ./tm-threads.h:195 #14 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f12e3fff680, pbd=0x7f0d50800000, ppd=0x7f0d508453e8) at source-af-packet.c:983 #15 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f12e3fff680, pbd=0x7f0d50800000) at source-af-packet.c:996 #16 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f12e3fff680) at source-af-packet.c:1043 #17 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14b65532d0, data=0x7f12e3fff680, slot=0x7f14bb8dfa50) at source-af-packet.c:1393 #18 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14b65532d0) at tm-threads.c:312 #19 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #20 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 45 (Thread 0x7f12e89cf700 (LWP 14040)): #0 0x00000000006f704e in DetectRunTx (tv=0x7f14bf8ebe90, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1293882740, p=0x7f129e4ff660, f=0x7ef785c3f110, scratch=0x7f12e89ce730) at detect.c:1361 #1 0x00000000006f5b96 in DetectRun (th_v=0x7f14bf8ebe90, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1293882740, p=0x7f129e4ff660) at detect.c:153 #2 0x00000000006f576f in DetectFlow (tv=0x7f14bf8ebe90, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1293882740, p=0x7f129e4ff660) at detect.c:1683 #3 0x00000000006f5618 in Detect (tv=0x7f14bf8ebe90, p=0x7f129e4ff660, data=0x7f1293882740) at detect.c:1755 #4 0x0000000000615618 in FlowWorker (tv=0x7f14bf8ebe90, p=0x7f129e4ff660, data=0x7f129e53b0f0) at flow-worker.c:552 #5 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14bf8ebe90, p=0x7f129e4ff660, slot=0x7f14c2b677b0) at tm-threads.c:117 #6 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14bf8ebe90, s=0x7f14c2b677b0, p=0x7f129e4ff660) at ./tm-threads.h:195 #7 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f12a7fff680, pbd=0x7f0ce2000000, ppd=0x7f0ce201c4d0) at source-af-packet.c:983 #8 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f12a7fff680, pbd=0x7f0ce2000000) at source-af-packet.c:996 #9 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f12a7fff680) at source-af-packet.c:1043 #10 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14bf8ebe90, data=0x7f12a7fff680, slot=0x7f14c2b5ed30) at source-af-packet.c:1393 #11 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14bf8ebe90) at tm-threads.c:312 #12 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #13 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 44 (Thread 0x7f1165f5c700 (LWP 14062)): #0 0x0000000000590f74 in DetectEnginePktInspectionRun (tv=0x7f14c2aadb80, det_ctx=0x7f112f882740, s=0x7f14c5b08620, f=0x7f076d550e50, p=0x7f113a4ff660, alert_flags=0x7f1165f5b6b7 "") at detect-engine.c:1811 #1 0x00000000006f6656 in DetectRulePacketRules (tv=0x7f14c2aadb80, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f112f882740, p=0x7f113a4ff660, pflow=0x7f076d550e50, scratch=0x7f1165f5b730) at detect.c:798 #2 0x00000000006f5a8e in DetectRun (th_v=0x7f14c2aadb80, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f112f882740, p=0x7f113a4ff660) at detect.c:136 #3 0x00000000006f576f in DetectFlow (tv=0x7f14c2aadb80, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f112f882740, p=0x7f113a4ff660) at detect.c:1683 #4 0x00000000006f5618 in Detect (tv=0x7f14c2aadb80, p=0x7f113a4ff660, data=0x7f112f882740) at detect.c:1755 #5 0x0000000000615618 in FlowWorker (tv=0x7f14c2aadb80, p=0x7f113a4ff660, data=0x7f113a53b0f0) at flow-worker.c:552 #6 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14c2aadb80, p=0x7f113a4ff660, slot=0x7f14c2e85be0) at tm-threads.c:117 #7 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14c2aadb80, s=0x7f14c2e85be0, p=0x7f113a4ff660) at ./tm-threads.h:195 #8 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f1143fff680, pbd=0x7f0a83000000, ppd=0x7f0a83086df0) at source-af-packet.c:983 #9 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f1143fff680, pbd=0x7f0a83000000) at source-af-packet.c:996 #10 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f1143fff680) at source-af-packet.c:1043 #11 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14c2aadb80, data=0x7f1143fff680, slot=0x7f14bb837960) at source-af-packet.c:1393 #12 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14c2aadb80) at tm-threads.c:312 #13 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 43 (Thread 0x7f1383fff700 (LWP 14027)): #0 0x00007f16389a5efc in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007f16389dd5a5 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x00007f16388e147b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #3 0x0000000000526a16 in SCHSSearch (mpm_ctx=0x7f14a23a6cc0, mpm_thread_ctx=0x7f136b882828, pmq=0x7f136b882858, buf=0x7f0e3e63ea78 , buflen=1024) at util-mpm-hs.c:946 #4 0x00000000005a6008 in PrefilterPktPayload (det_ctx=0x7f136b882740, p=0x7f13764ff660, pectx=0x7f14a23a6cc0) at detect-engine-payload.c:122 #5 0x00000000005a978c in Prefilter (det_ctx=0x7f136b882740, sgh=0x7f14a1df34a0, p=0x7f13764ff660, flags=8 '\b') at detect-engine-prefilter.c:182 #6 0x00000000006f63c0 in DetectRunPrefilterPkt (tv=0x7f14c2f90640, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f136b882740, p=0x7f13764ff660, scratch=0x7f1383ffe730) at detect.c:688 #7 0x00000000006f5a71 in DetectRun (th_v=0x7f14c2f90640, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f136b882740, p=0x7f13764ff660) at detect.c:132 #8 0x00000000006f576f in DetectFlow (tv=0x7f14c2f90640, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f136b882740, p=0x7f13764ff660) at detect.c:1683 #9 0x00000000006f5618 in Detect (tv=0x7f14c2f90640, p=0x7f13764ff660, data=0x7f136b882740) at detect.c:1755 #10 0x0000000000615618 in FlowWorker (tv=0x7f14c2f90640, p=0x7f13764ff660, data=0x7f137653b0f0) at flow-worker.c:552 #11 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14c2f90640, p=0x7f13764ff660, slot=0x7f14bef38610) at tm-threads.c:117 #12 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14c2f90640, s=0x7f14bef38610, p=0x7f13764ff660) at ./tm-threads.h:195 #13 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f137bfff680, pbd=0x7f0e3e600000, ppd=0x7f0e3e63e9e0) at source-af-packet.c:983 #14 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f137bfff680, pbd=0x7f0e3e600000) at source-af-packet.c:996 #15 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f137bfff680) at source-af-packet.c:1043 #16 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14c2f90640, data=0x7f137bfff680, slot=0x7f14a4daab00) at source-af-packet.c:1393 #17 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14c2f90640) at tm-threads.c:312 #18 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #19 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 42 (Thread 0x7f11ba4e7700 (LWP 14057)): #0 0x000000000060e764 in CmpAddrs (addr1=0x7f0491e71620, addr2=0x7f118e4ff664) at flow-hash.c:284 #1 0x000000000060e80f in CmpAddrsAndPorts (src1=0x7f0491e71620, dst1=0x7f0491e71630, src_port1=5353, dst_port1=36409, src2=0x7f118e4ff664, dst2=0x7f118e4ff678, src_port2=64356, dst_port2=5247) at flow-hash.c:296 #2 0x000000000060e442 in CmpFlowPacket (f=0x7f0491e71620, p=0x7f118e4ff660) at flow-hash.c:316 #3 0x000000000060d0d9 in FlowCompare (f=0x7f0491e71620, p=0x7f118e4ff660) at flow-hash.c:444 #4 0x000000000060c8f9 in FlowGetFlowFromHash (tv=0x7f14c2c95640, fls=0x7f118e53b138, p=0x7f118e4ff660, dest=0x7f118e4ff698) at flow-hash.c:808 #5 0x0000000000609dc2 in FlowHandlePacket (tv=0x7f14c2c95640, fls=0x7f118e53b138, p=0x7f118e4ff660) at flow.c:512 #6 0x000000000061545a in FlowWorker (tv=0x7f14c2c95640, p=0x7f118e4ff660, data=0x7f118e53b0f0) at flow-worker.c:502 #7 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14c2c95640, p=0x7f118e4ff660, slot=0x7f14c2ca09f0) at tm-threads.c:117 #8 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14c2c95640, s=0x7f14c2ca09f0, p=0x7f118e4ff660) at ./tm-threads.h:195 #9 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f1197fff680, pbd=0x7f0b0dc00000, ppd=0x7f0b0ddfd570) at source-af-packet.c:983 #10 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f1197fff680, pbd=0x7f0b0dc00000) at source-af-packet.c:996 #11 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f1197fff680) at source-af-packet.c:1043 #12 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14c2c95640, data=0x7f1197fff680, slot=0x7f14b6d53220) at source-af-packet.c:1393 #13 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14c2c95640) at tm-threads.c:312 #14 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #15 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 41 (Thread 0x7f1297a74700 (LWP 14041)): #0 0x00007f16389a5f76 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007f16389dd5a5 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x00007f16388e147b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #3 0x0000000000526a16 in SCHSSearch (mpm_ctx=0x7f14a237d770, mpm_thread_ctx=0x7f127f882828, pmq=0x7f127f882858, buf=0x7f0cc4a890f0 , buflen=90) at util-mpm-hs.c:946 #4 0x00000000005a6008 in PrefilterPktPayload (det_ctx=0x7f127f882740, p=0x7f128a4ff660, pectx=0x7f14a237d770) at detect-engine-payload.c:122 #5 0x00000000005a978c in Prefilter (det_ctx=0x7f127f882740, sgh=0x7f14a1f7a840, p=0x7f128a4ff660, flags=4 '\004') at detect-engine-prefilter.c:182 #6 0x00000000006f63c0 in DetectRunPrefilterPkt (tv=0x7f14badf86f0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f127f882740, p=0x7f128a4ff660, scratch=0x7f1297a73730) at detect.c:688 #7 0x00000000006f5a71 in DetectRun (th_v=0x7f14badf86f0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f127f882740, p=0x7f128a4ff660) at detect.c:132 #8 0x00000000006f576f in DetectFlow (tv=0x7f14badf86f0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f127f882740, p=0x7f128a4ff660) at detect.c:1683 #9 0x00000000006f5618 in Detect (tv=0x7f14badf86f0, p=0x7f128a4ff660, data=0x7f127f882740) at detect.c:1755 #10 0x0000000000615618 in FlowWorker (tv=0x7f14badf86f0, p=0x7f128a4ff660, data=0x7f128a53b0f0) at flow-worker.c:552 #11 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14badf86f0, p=0x7f128a4ff660, slot=0x7f14b3227680) at tm-threads.c:117 #12 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14badf86f0, s=0x7f14b3227680, p=0x7f128a4ff660) at ./tm-threads.h:195 #13 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f128ffff680, pbd=0x7f0cc4a00000, ppd=0x7f0cc4a89070) at source-af-packet.c:983 #14 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f128ffff680, pbd=0x7f0cc4a00000) at source-af-packet.c:996 #15 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f128ffff680) at source-af-packet.c:1043 #16 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14badf86f0, data=0x7f128ffff680, slot=0x7f14c03195d0) at source-af-packet.c:1393 #17 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14badf86f0) at tm-threads.c:312 #18 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #19 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 40 (Thread 0x7f132fa74700 (LWP 14032)): #0 DetectReplaceFree (det_ctx=0x7f1317882740) at ./detect-replace.h:39 #1 0x00000000006f66b4 in DetectRulePacketRules (tv=0x7f14bb2f89c0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1317882740, p=0x7f13224ff660, pflow=0x7ef79d6bc210, scratch=0x7f132fa73730) at detect.c:810 #2 0x00000000006f5a8e in DetectRun (th_v=0x7f14bb2f89c0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1317882740, p=0x7f13224ff660) at detect.c:136 #3 0x00000000006f576f in DetectFlow (tv=0x7f14bb2f89c0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1317882740, p=0x7f13224ff660) at detect.c:1683 #4 0x00000000006f5618 in Detect (tv=0x7f14bb2f89c0, p=0x7f13224ff660, data=0x7f1317882740) at detect.c:1755 #5 0x0000000000615618 in FlowWorker (tv=0x7f14bb2f89c0, p=0x7f13224ff660, data=0x7f132253b0f0) at flow-worker.c:552 #6 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14bb2f89c0, p=0x7f13224ff660, slot=0x7f14bd8c8630) at tm-threads.c:117 #7 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14bb2f89c0, s=0x7f14bd8c8630, p=0x7f13224ff660) at ./tm-threads.h:195 #8 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f1327fff680, pbd=0x7f0db9c00000, ppd=0x7f0db9c7a9b0) at source-af-packet.c:983 #9 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f1327fff680, pbd=0x7f0db9c00000) at source-af-packet.c:996 #10 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f1327fff680) at source-af-packet.c:1043 #11 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14bb2f89c0, data=0x7f1327fff680, slot=0x7f14ac409810) at source-af-packet.c:1393 #12 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14bb2f89c0) at tm-threads.c:312 #13 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 39 (Thread 0x7f138175b700 (LWP 14030)): #0 0x00000000005913c2 in DetectEngineInspectRulePacketMatches (det_ctx=0x7f133b882740, engine=0x7f14be2ba880, s=0x7f14c5b27c00, p=0x7f13464ff660, _alert_flags=0x7f138175a6b7 "") at detect-engine.c:1747 #1 0x0000000000590f98 in DetectEnginePktInspectionRun (tv=0x7f14c2fb28b0, det_ctx=0x7f133b882740, s=0x7f14c5b27c00, f=0x7f044e9170b0, p=0x7f13464ff660, alert_flags=0x7f138175a6b7 "") at detect-engine.c:1812 #2 0x00000000006f6656 in DetectRulePacketRules (tv=0x7f14c2fb28b0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f133b882740, p=0x7f13464ff660, pflow=0x7f044e9170b0, scratch=0x7f138175a730) at detect.c:798 #3 0x00000000006f5a8e in DetectRun (th_v=0x7f14c2fb28b0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f133b882740, p=0x7f13464ff660) at detect.c:136 #4 0x00000000006f576f in DetectFlow (tv=0x7f14c2fb28b0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f133b882740, p=0x7f13464ff660) at detect.c:1683 #5 0x00000000006f5618 in Detect (tv=0x7f14c2fb28b0, p=0x7f13464ff660, data=0x7f133b882740) at detect.c:1755 #6 0x0000000000615618 in FlowWorker (tv=0x7f14c2fb28b0, p=0x7f13464ff660, data=0x7f134653b0f0) at flow-worker.c:552 #7 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14c2fb28b0, p=0x7f13464ff660, slot=0x7f14bb77caf0) at tm-threads.c:117 #8 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14c2fb28b0, s=0x7f14bb77caf0, p=0x7f13464ff660) at ./tm-threads.h:195 #9 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f134ffff680, pbd=0x7f0de9a00000, ppd=0x7f0de9a25ec8) at source-af-packet.c:983 #10 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f134ffff680, pbd=0x7f0de9a00000) at source-af-packet.c:996 #11 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f134ffff680) at source-af-packet.c:1043 #12 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14c2fb28b0, data=0x7f134ffff680, slot=0x7f14c29639b0) at source-af-packet.c:1393 #13 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14c2fb28b0) at tm-threads.c:312 #14 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #15 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 38 (Thread 0x7f13c6ce8700 (LWP 14024)): #0 0x000000000066c241 in StreamTcpPacketStateEstablished (tv=0x7f14bdda5a60, p=0x7f13aa4ff660, stt=0x7f13b3fffc70, ssn=0x7ef5065e1200, pq=0x7f13b3fffc78) at stream-tcp.c:2578 #1 0x000000000066741c in StreamTcpStateDispatch (tv=0x7f14bdda5a60, p=0x7f13aa4ff660, stt=0x7f13b3fffc70, ssn=0x7ef5065e1200, pq=0x7f13b3fffc78, state=4 '\004') at stream-tcp.c:4777 #2 0x00000000006652b0 in StreamTcpPacket (tv=0x7f14bdda5a60, p=0x7f13aa4ff660, stt=0x7f13b3fffc70, pq=0x7f13aa53b120) at stream-tcp.c:4966 #3 0x0000000000667aa6 in StreamTcp (tv=0x7f14bdda5a60, p=0x7f13aa4ff660, data=0x7f13b3fffc70, pq=0x7f13aa53b120) at stream-tcp.c:5304 #4 0x0000000000615aa3 in FlowWorkerStreamTCPUpdate (tv=0x7f14bdda5a60, fw=0x7f13aa53b0f0, p=0x7f13aa4ff660, detect_thread=0x7f139f882740, timeout=false) at flow-worker.c:370 #5 0x0000000000615592 in FlowWorker (tv=0x7f14bdda5a60, p=0x7f13aa4ff660, data=0x7f13aa53b0f0) at flow-worker.c:536 #6 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14bdda5a60, p=0x7f13aa4ff660, slot=0x7f14c0338d80) at tm-threads.c:117 #7 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14bdda5a60, s=0x7f14c0338d80, p=0x7f13aa4ff660) at ./tm-threads.h:195 #8 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f13b3fff680, pbd=0x7f0ea1200000, ppd=0x7f0ea13f7488) at source-af-packet.c:983 #9 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f13b3fff680, pbd=0x7f0ea1200000) at source-af-packet.c:996 #10 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f13b3fff680) at source-af-packet.c:1043 #11 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14bdda5a60, data=0x7f13b3fff680, slot=0x7f14c4ff9500) at source-af-packet.c:1393 #12 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14bdda5a60) at tm-threads.c:312 #13 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 37 (Thread 0x7f11fdf5c700 (LWP 14053)): #0 0x00007f16389a61d4 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007f16389dd5a5 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x00007f16388e147b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #3 0x0000000000526a16 in SCHSSearch (mpm_ctx=0x7f14a259dc90, mpm_thread_ctx=0x7f11c7882828, pmq=0x7f11c7882858, buf=0x7f0b6f0b4348 , buflen=36) at util-mpm-hs.c:946 #4 0x00000000005a6008 in PrefilterPktPayload (det_ctx=0x7f11c7882740, p=0x7f11d24ff660, pectx=0x7f14a259dc90) at detect-engine-payload.c:122 #5 0x00000000005a978c in Prefilter (det_ctx=0x7f11c7882740, sgh=0x7f14c5ae71a0, p=0x7f11d24ff660, flags=4 '\004') at detect-engine-prefilter.c:182 #6 0x00000000006f63c0 in DetectRunPrefilterPkt (tv=0x7f14c2c3de00, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f11c7882740, p=0x7f11d24ff660, scratch=0x7f11fdf5b730) at detect.c:688 #7 0x00000000006f5a71 in DetectRun (th_v=0x7f14c2c3de00, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f11c7882740, p=0x7f11d24ff660) at detect.c:132 #8 0x00000000006f576f in DetectFlow (tv=0x7f14c2c3de00, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f11c7882740, p=0x7f11d24ff660) at detect.c:1683 #9 0x00000000006f5618 in Detect (tv=0x7f14c2c3de00, p=0x7f11d24ff660, data=0x7f11c7882740) at detect.c:1755 #10 0x0000000000615618 in FlowWorker (tv=0x7f14c2c3de00, p=0x7f11d24ff660, data=0x7f11d253b0f0) at flow-worker.c:552 #11 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14c2c3de00, p=0x7f11d24ff660, slot=0x7f14b6da31e0) at tm-threads.c:117 #12 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14c2c3de00, s=0x7f14b6da31e0, p=0x7f11d24ff660) at ./tm-threads.h:195 #13 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f11dbfff680, pbd=0x7f0b6f000000, ppd=0x7f0b6f0b42c8) at source-af-packet.c:983 #14 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f11dbfff680, pbd=0x7f0b6f000000) at source-af-packet.c:996 #15 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f11dbfff680) at source-af-packet.c:1043 #16 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14c2c3de00, data=0x7f11dbfff680, slot=0x7f14a7d7c560) at source-af-packet.c:1393 #17 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14c2c3de00) at tm-threads.c:312 #18 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #19 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 36 (Thread 0x7f11fd1d0700 (LWP 14054)): #0 msort_with_tmp (p=p@entry=0x7f11fd1cf4b0, b=b@entry=0x7f11b790bee0, n=n@entry=6) at msort.c:117 #1 0x00007f1637f9aee6 in msort_with_tmp (n=6, b=0x7f11b790bee0, p=0x7f11fd1cf4b0) at msort.c:297 #2 __GI___qsort_r (b=, n=, s=32, cmp=0x6f8c10 , arg=0x0) at msort.c:297 #3 0x00000000006f73af in DetectRunTx (tv=0x7f14c2c5ed40, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f11b7882740, p=0x7f11c24ff660, f=0x7efe034594b0, scratch=0x7f11fd1cf730) at detect.c:1415 #4 0x00000000006f5b96 in DetectRun (th_v=0x7f14c2c5ed40, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f11b7882740, p=0x7f11c24ff660) at detect.c:153 #5 0x00000000006f576f in DetectFlow (tv=0x7f14c2c5ed40, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f11b7882740, p=0x7f11c24ff660) at detect.c:1683 #6 0x00000000006f5618 in Detect (tv=0x7f14c2c5ed40, p=0x7f11c24ff660, data=0x7f11b7882740) at detect.c:1755 #7 0x0000000000615618 in FlowWorker (tv=0x7f14c2c5ed40, p=0x7f11c24ff660, data=0x7f11c253b0f0) at flow-worker.c:552 #8 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14c2c5ed40, p=0x7f11c24ff660, slot=0x7f14b8c191e0) at tm-threads.c:117 #9 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14c2c5ed40, s=0x7f14b8c191e0, p=0x7f11c24ff660) at ./tm-threads.h:195 #10 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f11cbfff680, pbd=0x7f0b69e00000, ppd=0x7f0b69e320a8) at source-af-packet.c:983 #11 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f11cbfff680, pbd=0x7f0b69e00000) at source-af-packet.c:996 #12 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f11cbfff680) at source-af-packet.c:1043 #13 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14c2c5ed40, data=0x7f11cbfff680, slot=0x7f14c2caa570) at source-af-packet.c:1393 #14 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14c2c5ed40) at tm-threads.c:312 #15 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #16 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 35 (Thread 0x7f13824e7700 (LWP 14029)): #0 0x0000000000529bb0 in PoolReturn (p=0x7f135786c290, data=0x7f03820ef3b0) at util-pool.c:360 #1 0x00000000006b8354 in PoolThreadReturn (pt=0x7f148786f350, data=0x7f03820ef3b0) at util-pool-thread.c:198 #2 0x0000000000663d79 in StreamTcpSessionClear (ssnptr=0x7f03820ef3b0) at stream-tcp.c:255 #3 0x000000000060b67e in FlowClearMemory (f=0x7f044e182c20, proto_map=0 '\000') at flow.c:1093 #4 0x0000000000616009 in CheckWorkQueue (tv=0x7f14b7c2ff40, fw=0x7f135653b0f0, detect_thread=0x7f134b882740, counters=0x7f13824e67a8, fq=0x7f13824e67d0) at flow-worker.c:192 #5 0x0000000000615dc9 in FlowWorkerProcessInjectedFlows (tv=0x7f14b7c2ff40, fw=0x7f135653b0f0, p=0x7f13564ff660, detect_thread=0x7f134b882740) at flow-worker.c:460 #6 0x0000000000615787 in FlowWorker (tv=0x7f14b7c2ff40, p=0x7f13564ff660, data=0x7f135653b0f0) at flow-worker.c:592 #7 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14b7c2ff40, p=0x7f13564ff660, slot=0x7f14ac42cc00) at tm-threads.c:117 #8 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14b7c2ff40, s=0x7f14ac42cc00, p=0x7f13564ff660) at ./tm-threads.h:195 #9 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f135ffff680, pbd=0x7f0e08400000, ppd=0x7f0e0846af58) at source-af-packet.c:983 #10 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f135ffff680, pbd=0x7f0e08400000) at source-af-packet.c:996 #11 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f135ffff680) at source-af-packet.c:1043 #12 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14b7c2ff40, data=0x7f135ffff680, slot=0x7f14c2957a80) at source-af-packet.c:1393 #13 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14b7c2ff40) at tm-threads.c:312 #14 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #15 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 34 (Thread 0x7f1088f5a700 (LWP 14077)): #0 FlowQueuePrivateAppendFlow (fqc=0x7f1088f59888, f=0x7ef7a8c39030) at flow-queue.c:74 #1 0x0000000000610f50 in ProcessAsideQueue (td=0x7f1040000b90, counters=0x7f1088f59a30) at flow-manager.c:300 #2 0x0000000000610b42 in FlowTimeoutHash (td=0x7f1040000b90, ts=0x7f1088f59af0, hash_min=4816635, hash_max=4833301, counters=0x7f1088f59a30) at flow-manager.c:473 #3 0x0000000000610c3c in FlowTimeoutHashInChunks (td=0x7f1040000b90, ts=0x7f1088f59af0, hash_min=4000001, hash_max=8000000, counters=0x7f1088f59a30, iter=49, chunks=240) at flow-manager.c:504 #4 0x000000000060fa36 in FlowManager (th_v=0x7f14c29ed4d0, thread_data=0x7f1040000b60) at flow-manager.c:851 #5 0x0000000000509d76 in TmThreadsManagement (td=0x7f14c29ed4d0) at tm-threads.c:552 #6 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #7 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 33 (Thread 0x7f132ece8700 (LWP 14033)): #0 0x00007f1638067aff in __GI___poll (fds=0x7f132ece7aa0, nfds=1, timeout=100) at ../sysdeps/unix/sysv/linux/poll.c:29 #1 0x00000000006570b1 in ReceiveAFPLoop (tv=0x7f14af70f510, data=0x7f131bfff680, slot=0x7f14c5520a70) at source-af-packet.c:1364 #2 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14af70f510) at tm-threads.c:312 #3 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #4 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 32 (Thread 0x7f12eb273700 (LWP 14037)): #0 0x00007f16389a6e37 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007f16389dd5a5 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x00007f16388e147b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #3 0x0000000000526a16 in SCHSSearch (mpm_ctx=0x7f14a23d2bf0, mpm_thread_ctx=0x7f12c3882828, pmq=0x7f12c3882858, buf=0x7f0d2402e7b8 , buflen=1386) at util-mpm-hs.c:946 #4 0x00000000005a6008 in PrefilterPktPayload (det_ctx=0x7f12c3882740, p=0x7f12ce4ff660, pectx=0x7f14a23d2bf0) at detect-engine-payload.c:122 #5 0x00000000005a978c in Prefilter (det_ctx=0x7f12c3882740, sgh=0x7f14a23d7f00, p=0x7f12ce4ff660, flags=4 '\004') at detect-engine-prefilter.c:182 #6 0x00000000006f63c0 in DetectRunPrefilterPkt (tv=0x7f14b202d360, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f12c3882740, p=0x7f12ce4ff660, scratch=0x7f12eb272730) at detect.c:688 #7 0x00000000006f5a71 in DetectRun (th_v=0x7f14b202d360, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f12c3882740, p=0x7f12ce4ff660) at detect.c:132 #8 0x00000000006f576f in DetectFlow (tv=0x7f14b202d360, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f12c3882740, p=0x7f12ce4ff660) at detect.c:1683 #9 0x00000000006f5618 in Detect (tv=0x7f14b202d360, p=0x7f12ce4ff660, data=0x7f12c3882740) at detect.c:1755 #10 0x0000000000615618 in FlowWorker (tv=0x7f14b202d360, p=0x7f12ce4ff660, data=0x7f12ce53b0f0) at flow-worker.c:552 #11 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14b202d360, p=0x7f12ce4ff660, slot=0x7f14ac51ca10) at tm-threads.c:117 #12 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14b202d360, s=0x7f14ac51ca10, p=0x7f12ce4ff660) at ./tm-threads.h:195 #13 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f12d7fff680, pbd=0x7f0d24000000, ppd=0x7f0d2402e728) at source-af-packet.c:983 #14 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f12d7fff680, pbd=0x7f0d24000000) at source-af-packet.c:996 #15 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f12d7fff680) at source-af-packet.c:1043 #16 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14b202d360, data=0x7f12d7fff680, slot=0x7f14af699e00) at source-af-packet.c:1393 #17 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14b202d360) at tm-threads.c:312 #18 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #19 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 31 (Thread 0x7f1295f5c700 (LWP 14044)): #0 0x00000000006092a3 in FlowGetPacketDirection (f=0x7f05bd8e5840, p=0x7f126a4ff660) at flow.c:294 #1 0x000000000060947a in FlowHandlePacketUpdate (f=0x7f05bd8e5840, p=0x7f126a4ff660, tv=0x7f14a38e2e30, dtv=0x7f126a53b390) at flow.c:394 #2 0x000000000061592f in FlowUpdate (tv=0x7f14a38e2e30, fw=0x7f126a53b0f0, p=0x7f126a4ff660) at flow-worker.c:208 #3 0x0000000000615491 in FlowWorker (tv=0x7f14a38e2e30, p=0x7f126a4ff660, data=0x7f126a53b0f0) at flow-worker.c:505 #4 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14a38e2e30, p=0x7f126a4ff660, slot=0x7f14a85716b0) at tm-threads.c:117 #5 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14a38e2e30, s=0x7f14a85716b0, p=0x7f126a4ff660) at ./tm-threads.h:195 #6 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f1273fff680, pbd=0x7f0c73a00000, ppd=0x7f0c73a99e70) at source-af-packet.c:983 #7 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f1273fff680, pbd=0x7f0c73a00000) at source-af-packet.c:996 #8 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f1273fff680) at source-af-packet.c:1043 #9 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14a38e2e30, data=0x7f1273fff680, slot=0x7f14a6bdfa50) at source-af-packet.c:1393 #10 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14a38e2e30) at tm-threads.c:312 #11 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #12 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 30 (Thread 0x7f148e5b0700 (LWP 14011)): #0 0x00007f16389dd434 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007f16388e147b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x0000000000526a16 in SCHSSearch (mpm_ctx=0x7f14a259dc90, mpm_thread_ctx=0x7f147b885a28, pmq=0x7f147b885a58, buf=0x7f1017667e64 , buflen=192) at util-mpm-hs.c:946 #3 0x00000000005a6008 in PrefilterPktPayload (det_ctx=0x7f147b885940, p=0x7f14864ff660, pectx=0x7f14a259dc90) at detect-engine-payload.c:122 #4 0x00000000005a978c in Prefilter (det_ctx=0x7f147b885940, sgh=0x7f14a2291fd0, p=0x7f14864ff660, flags=4 '\004') at detect-engine-prefilter.c:182 #5 0x00000000006f63c0 in DetectRunPrefilterPkt (tv=0x7f14a2256a40, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f147b885940, p=0x7f14864ff660, scratch=0x7f148e5af730) at detect.c:688 #6 0x00000000006f5a71 in DetectRun (th_v=0x7f14a2256a40, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f147b885940, p=0x7f14864ff660) at detect.c:132 #7 0x00000000006f576f in DetectFlow (tv=0x7f14a2256a40, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f147b885940, p=0x7f14864ff660) at detect.c:1683 #8 0x00000000006f5618 in Detect (tv=0x7f14a2256a40, p=0x7f14864ff660, data=0x7f147b885940) at detect.c:1755 #9 0x0000000000615618 in FlowWorker (tv=0x7f14a2256a40, p=0x7f14864ff660, data=0x7f148653e150) at flow-worker.c:552 #10 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14a2256a40, p=0x7f14864ff660, slot=0x7f149965d7c0) at tm-threads.c:117 #11 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14a2256a40, s=0x7f149965d7c0, p=0x7f14864ff660) at ./tm-threads.h:195 #12 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f148bfff680, pbd=0x7f1017600000, ppd=0x7f1017667de0) at source-af-packet.c:983 #13 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f148bfff680, pbd=0x7f1017600000) at source-af-packet.c:996 #14 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f148bfff680) at source-af-packet.c:1043 #15 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14a2256a40, data=0x7f148bfff680, slot=0x7f1497c3b710) at source-af-packet.c:1393 #16 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14a2256a40) at tm-threads.c:312 #17 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #18 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 29 (Thread 0x7f1383273700 (LWP 14028)): #0 0x00007f1638067aff in __GI___poll (fds=0x7f1383272aa0, nfds=1, timeout=100) at ../sysdeps/unix/sysv/linux/poll.c:29 #1 0x00000000006570b1 in ReceiveAFPLoop (tv=0x7f14aead0560, data=0x7f136ffff680, slot=0x7f14a7da6c60) at source-af-packet.c:1364 #2 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14aead0560) at tm-threads.c:312 #3 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #4 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 28 (Thread 0x7f12951d0700 (LWP 14045)): #0 0x00000000005641bc in StatsAddUI64 (tv=0x7f14af1b6bc0, id=40, x=94) at counters.c:158 #1 0x000000000056ce15 in DecodeUpdatePacketCounters (tv=0x7f14af1b6bc0, dtv=0x7f1263fffcc0, p=0x7f125a4ff660) at decode.c:625 #2 0x0000000000657994 in DecodeAFP (tv=0x7f14af1b6bc0, p=0x7f125a4ff660, data=0x7f1263fffcc0) at source-af-packet.c:2707 #3 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14af1b6bc0, p=0x7f125a4ff660, slot=0x7f14c2b1bb40) at tm-threads.c:117 #4 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14af1b6bc0, s=0x7f14c2b1bb40, p=0x7f125a4ff660) at ./tm-threads.h:195 #5 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f1263fff680, pbd=0x7f0c6e400000, ppd=0x7f0c6e4542f0) at source-af-packet.c:983 #6 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f1263fff680, pbd=0x7f0c6e400000) at source-af-packet.c:996 #7 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f1263fff680) at source-af-packet.c:1043 #8 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14af1b6bc0, data=0x7f1263fff680, slot=0x7f14c2aff8f0) at source-af-packet.c:1393 #9 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14af1b6bc0) at tm-threads.c:312 #10 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #11 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 27 (Thread 0x7f145d1d0700 (LWP 14017)): #0 0x00000000006f64d5 in DetectRulePacketRules (tv=0x7f14a1fed980, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f14178824e0, p=0x7f14224ff660, pflow=0x7f048d0e6a30, scratch=0x7f145d1cf730) at detect.c:756 #1 0x00000000006f5a8e in DetectRun (th_v=0x7f14a1fed980, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f14178824e0, p=0x7f14224ff660) at detect.c:136 #2 0x00000000006f576f in DetectFlow (tv=0x7f14a1fed980, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f14178824e0, p=0x7f14224ff660) at detect.c:1683 #3 0x00000000006f5618 in Detect (tv=0x7f14a1fed980, p=0x7f14224ff660, data=0x7f14178824e0) at detect.c:1755 #4 0x0000000000615618 in FlowWorker (tv=0x7f14a1fed980, p=0x7f14224ff660, data=0x7f142253b0f0) at flow-worker.c:552 #5 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14a1fed980, p=0x7f14224ff660, slot=0x7f14b68223f0) at tm-threads.c:117 #6 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14a1fed980, s=0x7f14b68223f0, p=0x7f14224ff660) at ./tm-threads.h:195 #7 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f142bfff680, pbd=0x7f0f69a00000, ppd=0x7f0f69a90af0) at source-af-packet.c:983 #8 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f142bfff680, pbd=0x7f0f69a00000) at source-af-packet.c:996 #9 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f142bfff680) at source-af-packet.c:1043 #10 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14a1fed980, data=0x7f142bfff680, slot=0x7f14b973da00) at source-af-packet.c:1393 #11 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14a1fed980) at tm-threads.c:312 #12 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #13 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 26 (Thread 0x7f148ca98700 (LWP 14013)): #0 DetectRunInspectRuleHeader (p=0x7f14664ff660, f=0x7f14c627b890, s=0x7f14c5b3e4e0, sflags=1572879, s_proto_flags=1 '\001') at detect.c:609 #1 0x00000000006f662b in DetectRulePacketRules (tv=0x7f14a2256b70, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f145b882760, p=0x7f14664ff660, pflow=0x7f14c627b890, scratch=0x7f148ca97730) at detect.c:794 #2 0x00000000006f5a8e in DetectRun (th_v=0x7f14a2256b70, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f145b882760, p=0x7f14664ff660) at detect.c:136 #3 0x00000000006f576f in DetectFlow (tv=0x7f14a2256b70, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f145b882760, p=0x7f14664ff660) at detect.c:1683 #4 0x00000000006f5618 in Detect (tv=0x7f14a2256b70, p=0x7f14664ff660, data=0x7f145b882760) at detect.c:1755 #5 0x0000000000615618 in FlowWorker (tv=0x7f14a2256b70, p=0x7f14664ff660, data=0x7f146653b0f0) at flow-worker.c:552 #6 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14a2256b70, p=0x7f14664ff660, slot=0x7f14a2c825a0) at tm-threads.c:117 #7 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14a2256b70, s=0x7f14a2c825a0, p=0x7f14664ff660) at ./tm-threads.h:195 #8 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f146ffff680, pbd=0x7f0fe1000000, ppd=0x7f0fe1037be0) at source-af-packet.c:983 #9 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f146ffff680, pbd=0x7f0fe1000000) at source-af-packet.c:996 #10 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f146ffff680) at source-af-packet.c:1043 #11 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14a2256b70, data=0x7f146ffff680, slot=0x7f14bb711de0) at source-af-packet.c:1393 #12 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14a2256b70) at tm-threads.c:312 #13 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 25 (Thread 0x7f145df5c700 (LWP 14016)): #0 DetectRunInspectRuleHeader (p=0x7f14324ff660, f=0x7ef722021f10, s=0x7f14c5b33cb0, sflags=1572879, s_proto_flags=1 '\001') at detect.c:600 #1 0x00000000006f662b in DetectRulePacketRules (tv=0x7f1497a7a480, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1427882740, p=0x7f14324ff660, pflow=0x7ef722021f10, scratch=0x7f145df5b730) at detect.c:794 #2 0x00000000006f5a8e in DetectRun (th_v=0x7f1497a7a480, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1427882740, p=0x7f14324ff660) at detect.c:136 #3 0x00000000006f576f in DetectFlow (tv=0x7f1497a7a480, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1427882740, p=0x7f14324ff660) at detect.c:1683 #4 0x00000000006f5618 in Detect (tv=0x7f1497a7a480, p=0x7f14324ff660, data=0x7f1427882740) at detect.c:1755 #5 0x0000000000615618 in FlowWorker (tv=0x7f1497a7a480, p=0x7f14324ff660, data=0x7f143253b0f0) at flow-worker.c:552 #6 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f1497a7a480, p=0x7f14324ff660, slot=0x7f14c01ee220) at tm-threads.c:117 #7 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f1497a7a480, s=0x7f14c01ee220, p=0x7f14324ff660) at ./tm-threads.h:195 #8 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f143bfff680, pbd=0x7f0f8fe00000, ppd=0x7f0f8fe32ef8) at source-af-packet.c:983 #9 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f143bfff680, pbd=0x7f0f8fe00000) at source-af-packet.c:996 #10 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f143bfff680) at source-af-packet.c:1043 #11 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f1497a7a480, data=0x7f143bfff680, slot=0x7f14b7819070) at source-af-packet.c:1393 #12 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f1497a7a480) at tm-threads.c:312 #13 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 24 (Thread 0x7f141975b700 (LWP 14021)): #0 0x00000000005913a5 in DetectEngineInspectRulePacketMatches (det_ctx=0x7f13d3882740, engine=0x7f14bdfeec60, s=0x7f14c5b0dfb0, p=0x7f13de4ff660, _alert_flags=0x7f141975a6b7 "") at detect-engine.c:1745 #1 0x0000000000590f98 in DetectEnginePktInspectionRun (tv=0x7f14bdd8b720, det_ctx=0x7f13d3882740, s=0x7f14c5b0dfb0, f=0x7f07b0d9d2d0, p=0x7f13de4ff660, alert_flags=0x7f141975a6b7 "") at detect-engine.c:1812 #2 0x00000000006f6656 in DetectRulePacketRules (tv=0x7f14bdd8b720, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f13d3882740, p=0x7f13de4ff660, pflow=0x7f07b0d9d2d0, scratch=0x7f141975a730) at detect.c:798 #3 0x00000000006f5a8e in DetectRun (th_v=0x7f14bdd8b720, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f13d3882740, p=0x7f13de4ff660) at detect.c:136 #4 0x00000000006f576f in DetectFlow (tv=0x7f14bdd8b720, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f13d3882740, p=0x7f13de4ff660) at detect.c:1683 #5 0x00000000006f5618 in Detect (tv=0x7f14bdd8b720, p=0x7f13de4ff660, data=0x7f13d3882740) at detect.c:1755 #6 0x0000000000615618 in FlowWorker (tv=0x7f14bdd8b720, p=0x7f13de4ff660, data=0x7f13de53b0f0) at flow-worker.c:552 #7 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14bdd8b720, p=0x7f13de4ff660, slot=0x7f14b8138220) at tm-threads.c:117 #8 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14bdd8b720, s=0x7f14b8138220, p=0x7f13de4ff660) at ./tm-threads.h:195 #9 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f13e7fff680, pbd=0x7f0ef7200000, ppd=0x7f0ef72b6048) at source-af-packet.c:983 #10 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f13e7fff680, pbd=0x7f0ef7200000) at source-af-packet.c:996 #11 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f13e7fff680) at source-af-packet.c:1043 #12 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14bdd8b720, data=0x7f13e7fff680, slot=0x7f14af721bb0) at source-af-packet.c:1393 #13 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14bdd8b720) at tm-threads.c:312 #14 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #15 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 23 (Thread 0x7f13c5f5c700 (LWP 14025)): #0 0x00007f16388f0506 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007f16388f2c25 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x00007f16389dd52a in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #3 0x00007f16388e147b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #4 0x0000000000526a16 in SCHSSearch (mpm_ctx=0x7f14a237d770, mpm_thread_ctx=0x7f138f882828, pmq=0x7f138f882858, buf=0x7f0e8261ebc8 , buflen=1470) at util-mpm-hs.c:946 #5 0x00000000005a6008 in PrefilterPktPayload (det_ctx=0x7f138f882740, p=0x7f139a4ff660, pectx=0x7f14a237d770) at detect-engine-payload.c:122 #6 0x00000000005a978c in Prefilter (det_ctx=0x7f138f882740, sgh=0x7f14a2289af0, p=0x7f139a4ff660, flags=4 '\004') at detect-engine-prefilter.c:182 #7 0x00000000006f63c0 in DetectRunPrefilterPkt (tv=0x7f14bdda1280, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f138f882740, p=0x7f139a4ff660, scratch=0x7f13c5f5b730) at detect.c:688 #8 0x00000000006f5a71 in DetectRun (th_v=0x7f14bdda1280, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f138f882740, p=0x7f139a4ff660) at detect.c:132 #9 0x00000000006f576f in DetectFlow (tv=0x7f14bdda1280, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f138f882740, p=0x7f139a4ff660) at detect.c:1683 #10 0x00000000006f5618 in Detect (tv=0x7f14bdda1280, p=0x7f139a4ff660, data=0x7f138f882740) at detect.c:1755 #11 0x0000000000615618 in FlowWorker (tv=0x7f14bdda1280, p=0x7f139a4ff660, data=0x7f139a53b0f0) at flow-worker.c:552 #12 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14bdda1280, p=0x7f139a4ff660, slot=0x7f14c04f4ab0) at tm-threads.c:117 #13 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14bdda1280, s=0x7f14c04f4ab0, p=0x7f139a4ff660) at ./tm-threads.h:195 #14 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f13a3fff680, pbd=0x7f0e82600000, ppd=0x7f0e8261eb48) at source-af-packet.c:983 #15 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f13a3fff680, pbd=0x7f0e82600000) at source-af-packet.c:996 #16 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f13a3fff680) at source-af-packet.c:1043 #17 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14bdda1280, data=0x7f13a3fff680, slot=0x7f14c04ebbf0) at source-af-packet.c:1393 #18 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14bdda1280) at tm-threads.c:312 #19 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #20 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 22 (Thread 0x7f1296ce8700 (LWP 14042)): #0 0x00000000006f80c7 in DetectPrefilterMergeSort (de_ctx=0x7f14c5c7fe50, det_ctx=0x7f126f882740) at detect.c:354 #1 0x00000000006f63ef in DetectRunPrefilterPkt (tv=0x7f14b502ebf0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f126f882740, p=0x7f127a4fd770, scratch=0x7f1296ce76e0) at detect.c:697 #2 0x00000000006f5a71 in DetectRun (th_v=0x7f14b502ebf0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f126f882740, p=0x7f127a4fd770) at detect.c:132 #3 0x00000000006f576f in DetectFlow (tv=0x7f14b502ebf0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f126f882740, p=0x7f127a4fd770) at detect.c:1683 #4 0x00000000006f5618 in Detect (tv=0x7f14b502ebf0, p=0x7f127a4fd770, data=0x7f126f882740) at detect.c:1755 #5 0x0000000000615618 in FlowWorker (tv=0x7f14b502ebf0, p=0x7f127a4fd770, data=0x7f127a53b0f0) at flow-worker.c:552 #6 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14b502ebf0, p=0x7f127a4fd770, slot=0x7f14c05fc8f0) at tm-threads.c:117 #7 0x00000000005048d0 in TmThreadsSlotVarRun (tv=0x7f14b502ebf0, p=0x7f127a4ff660, slot=0x7f14c05f27f0) at tm-threads.c:135 #8 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14b502ebf0, s=0x7f14c05f27f0, p=0x7f127a4ff660) at ./tm-threads.h:195 #9 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f1283fff680, pbd=0x7f0c8ec00000, ppd=0x7f0c8ec91968) at source-af-packet.c:983 #10 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f1283fff680, pbd=0x7f0c8ec00000) at source-af-packet.c:996 #11 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f1283fff680) at source-af-packet.c:1043 #12 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14b502ebf0, data=0x7f1283fff680, slot=0x7f14c2b31430) at source-af-packet.c:1393 #13 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14b502ebf0) at tm-threads.c:312 #14 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #15 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 21 (Thread 0x7f1123273700 (LWP 14065)): #0 DetectRulePacketRules (tv=0x7f14c2af44c0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f10fb882740, p=0x7f11064ff660, pflow=0x7ef9074f8d80, scratch=0x7f1123272730) at detect.c:758 #1 0x00000000006f5a8e in DetectRun (th_v=0x7f14c2af44c0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f10fb882740, p=0x7f11064ff660) at detect.c:136 #2 0x00000000006f576f in DetectFlow (tv=0x7f14c2af44c0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f10fb882740, p=0x7f11064ff660) at detect.c:1683 #3 0x00000000006f5618 in Detect (tv=0x7f14c2af44c0, p=0x7f11064ff660, data=0x7f10fb882740) at detect.c:1755 #4 0x0000000000615618 in FlowWorker (tv=0x7f14c2af44c0, p=0x7f11064ff660, data=0x7f110653b0f0) at flow-worker.c:552 #5 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14c2af44c0, p=0x7f11064ff660, slot=0x7f14c2e4c4b0) at tm-threads.c:117 #6 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14c2af44c0, s=0x7f14c2e4c4b0, p=0x7f11064ff660) at ./tm-threads.h:195 #7 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f110ffff680, pbd=0x7f0a24000000, ppd=0x7f0a24084628) at source-af-packet.c:983 #8 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f110ffff680, pbd=0x7f0a24000000) at source-af-packet.c:996 #9 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f110ffff680) at source-af-packet.c:1043 #10 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14c2af44c0, data=0x7f110ffff680, slot=0x7f14bcc36030) at source-af-packet.c:1393 #11 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14c2af44c0) at tm-threads.c:312 #12 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #13 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 20 (Thread 0x7f132df5c700 (LWP 14034)): #0 0x0000000000591371 in DetectEngineInspectRulePacketMatches (det_ctx=0x7f14b45009f0, engine=0x7f12f7882740, s=0x7f14c5b09260, p=0x7f14c9c52490, _alert_flags=0x7f13024ff660 "\002") at detect-engine.c:1737 #1 0x0000000000590f98 in DetectEnginePktInspectionRun (tv=0x7f14b45009f0, det_ctx=0x7f12f7882740, s=0x7f14c5b09260, f=0x7f14c9c52490, p=0x7f13024ff660, alert_flags=0x7f132df5b6b7 "") at detect-engine.c:1812 #2 0x00000000006f6656 in DetectRulePacketRules (tv=0x7f14b45009f0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f12f7882740, p=0x7f13024ff660, pflow=0x7f14c9c52490, scratch=0x7f132df5b730) at detect.c:798 #3 0x00000000006f5a8e in DetectRun (th_v=0x7f14b45009f0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f12f7882740, p=0x7f13024ff660) at detect.c:136 #4 0x00000000006f576f in DetectFlow (tv=0x7f14b45009f0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f12f7882740, p=0x7f13024ff660) at detect.c:1683 #5 0x00000000006f5618 in Detect (tv=0x7f14b45009f0, p=0x7f13024ff660, data=0x7f12f7882740) at detect.c:1755 #6 0x0000000000615618 in FlowWorker (tv=0x7f14b45009f0, p=0x7f13024ff660, data=0x7f130253b0f0) at flow-worker.c:552 #7 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14b45009f0, p=0x7f13024ff660, slot=0x7f14c2b9d430) at tm-threads.c:117 #8 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14b45009f0, s=0x7f14c2b9d430, p=0x7f13024ff660) at ./tm-threads.h:195 #9 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f130bfff680, pbd=0x7f0d82c00000, ppd=0x7f0d82c818f0) at source-af-packet.c:983 #10 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f130bfff680, pbd=0x7f0d82c00000) at source-af-packet.c:996 #11 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f130bfff680) at source-af-packet.c:1043 #12 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14b45009f0, data=0x7f130bfff680, slot=0x7f14b0d9d530) at source-af-packet.c:1393 #13 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14b45009f0) at tm-threads.c:312 #14 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #15 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 19 (Thread 0x7f108bfff700 (LWP 14073)): #0 DetectReplaceFree (det_ctx=0x7f14c299c8f0) at ./detect-replace.h:34 #1 0x00000000006f66b4 in DetectRulePacketRules (tv=0x7f14c299c8f0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1073882740, p=0x7f107e4ff660, pflow=0x7efe05881ae0, scratch=0x7f108bffe730) at detect.c:810 #2 0x00000000006f5a8e in DetectRun (th_v=0x7f14c299c8f0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1073882740, p=0x7f107e4ff660) at detect.c:136 #3 0x00000000006f576f in DetectFlow (tv=0x7f14c299c8f0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1073882740, p=0x7f107e4ff660) at detect.c:1683 #4 0x00000000006f5618 in Detect (tv=0x7f14c299c8f0, p=0x7f107e4ff660, data=0x7f1073882740) at detect.c:1755 #5 0x0000000000615618 in FlowWorker (tv=0x7f14c299c8f0, p=0x7f107e4ff660, data=0x7f107e53b0f0) at flow-worker.c:552 #6 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14c299c8f0, p=0x7f107e4ff660, slot=0x7f14bd591920) at tm-threads.c:117 #7 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14c299c8f0, s=0x7f14bd591920, p=0x7f107e4ff660) at ./tm-threads.h:195 #8 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f1083fff680, pbd=0x7f0938000000, ppd=0x7f093805f7e0) at source-af-packet.c:983 #9 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f1083fff680, pbd=0x7f0938000000) at source-af-packet.c:996 #10 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f1083fff680) at source-af-packet.c:1043 #11 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14c299c8f0, data=0x7f1083fff680, slot=0x7f14b2edc250) at source-af-packet.c:1393 #12 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14c299c8f0) at tm-threads.c:312 #13 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 18 (Thread 0x7f108a4e7700 (LWP 14075)): #0 0x00007f16389a5eee in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007f16389dd5a5 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x00007f16388e147b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #3 0x0000000000526a16 in SCHSSearch (mpm_ctx=0x7f14a237d770, mpm_thread_ctx=0x7f1053882828, pmq=0x7f1053882858, buf=0x7f09100d4410 , buflen=919) at util-mpm-hs.c:946 #4 0x00000000005a6008 in PrefilterPktPayload (det_ctx=0x7f1053882740, p=0x7f105e4ff660, pectx=0x7f14a237d770) at detect-engine-payload.c:122 #5 0x00000000005a978c in Prefilter (det_ctx=0x7f1053882740, sgh=0x7f14a1c128e0, p=0x7f105e4ff660, flags=4 '\004') at detect-engine-prefilter.c:182 #6 0x00000000006f63c0 in DetectRunPrefilterPkt (tv=0x7f14c29ceda0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1053882740, p=0x7f105e4ff660, scratch=0x7f108a4e6730) at detect.c:688 #7 0x00000000006f5a71 in DetectRun (th_v=0x7f14c29ceda0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1053882740, p=0x7f105e4ff660) at detect.c:132 #8 0x00000000006f576f in DetectFlow (tv=0x7f14c29ceda0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1053882740, p=0x7f105e4ff660) at detect.c:1683 #9 0x00000000006f5618 in Detect (tv=0x7f14c29ceda0, p=0x7f105e4ff660, data=0x7f1053882740) at detect.c:1755 #10 0x0000000000615618 in FlowWorker (tv=0x7f14c29ceda0, p=0x7f105e4ff660, data=0x7f105e53b0f0) at flow-worker.c:552 #11 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14c29ceda0, p=0x7f105e4ff660, slot=0x7f14b8d44d90) at tm-threads.c:117 #12 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14c29ceda0, s=0x7f14b8d44d90, p=0x7f105e4ff660) at ./tm-threads.h:195 #13 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f1067fff680, pbd=0x7f0910000000, ppd=0x7f09100d4390) at source-af-packet.c:983 #14 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f1067fff680, pbd=0x7f0910000000) at source-af-packet.c:996 #15 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f1067fff680) at source-af-packet.c:1043 #16 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14c29ceda0, data=0x7f1067fff680, slot=0x7f14c0f5dcb0) at source-af-packet.c:1393 #17 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14c29ceda0) at tm-threads.c:312 #18 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #19 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 17 (Thread 0x7f1167a74700 (LWP 14060)): #0 0x0000000000502ce3 in PacketPoolGetPacket () at tmqh-packetpool.c:197 #1 0x000000000056b85d in PacketGetFromQueueOrAlloc () at decode.c:192 #2 0x0000000000659029 in AFPParsePacketV3 (ptv=0x7f115ffff680, pbd=0x7f0ab2800000, ppd=0x7f0ab290a378) at source-af-packet.c:934 #3 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f115ffff680, pbd=0x7f0ab2800000) at source-af-packet.c:996 #4 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f115ffff680) at source-af-packet.c:1043 #5 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14c2cb6740, data=0x7f115ffff680, slot=0x7f14c0cb9170) at source-af-packet.c:1393 #6 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14c2cb6740) at tm-threads.c:312 #7 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #8 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 16 (Thread 0x7f13c7a74700 (LWP 14023)): #0 0x00000000005c9231 in GetResponseData (det_ctx=0x7f1499a3ca40, transforms=0x7f13ba4fb880, _f=0x7f0672eeb840, _flow_flags=0 '\000', txv=0x0, list_id=32532) at ./detect-http-headers-stub.h:112 #1 0x00000000005aaf14 in PrefilterMpm (det_ctx=0x7f13af882740, pectx=0x7f1499a3ca40, p=0x7f13ba4fb880, f=0x7f0672eeb840, txv=0x7f0844ce4ea0, idx=0, flags=138 '\212') at detect-engine-prefilter.c:731 #2 0x00000000005a948e in DetectRunPrefilterTx (det_ctx=0x7f13af882740, sgh=0x7f14a2289be0, p=0x7f13ba4fb880, ipproto=6 '\006', flow_flags=138 '\212', alproto=1, alstate=0x7efb77a62a10, tx=0x7f13c7a734b0) at detect-engine-prefilter.c:121 #3 0x00000000006f6e6e in DetectRunTx (tv=0x7f14bdda22b0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f13af882740, p=0x7f13ba4fb880, f=0x7f0672eeb840, scratch=0x7f13c7a735c0) at detect.c:1330 #4 0x00000000006f5b96 in DetectRun (th_v=0x7f14bdda22b0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f13af882740, p=0x7f13ba4fb880) at detect.c:153 #5 0x00000000006f576f in DetectFlow (tv=0x7f14bdda22b0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f13af882740, p=0x7f13ba4fb880) at detect.c:1683 #6 0x00000000006f5618 in Detect (tv=0x7f14bdda22b0, p=0x7f13ba4fb880, data=0x7f13af882740) at detect.c:1755 #7 0x000000000061635d in FlowWorkerFlowTimeout (tv=0x7f14bdda22b0, p=0x7f13ba4fb880, fw=0x7f13ba53b0f0, detect_thread=0x7f13af882740) at flow-worker.c:421 #8 0x00000000006162c8 in FlowFinish (tv=0x7f14bdda22b0, f=0x7f0672eeb840, fw=0x7f13ba53b0f0, detect_thread=0x7f13af882740) at flow-worker.c:157 #9 0x0000000000615f7c in CheckWorkQueue (tv=0x7f14bdda22b0, fw=0x7f13ba53b0f0, detect_thread=0x7f13af882740, counters=0x7f13c7a737a8, fq=0x7f13c7a737d0) at flow-worker.c:177 #10 0x0000000000615dc9 in FlowWorkerProcessInjectedFlows (tv=0x7f14bdda22b0, fw=0x7f13ba53b0f0, p=0x7f13ba4ff660, detect_thread=0x7f13af882740) at flow-worker.c:460 #11 0x0000000000615787 in FlowWorker (tv=0x7f14bdda22b0, p=0x7f13ba4ff660, data=0x7f13ba53b0f0) at flow-worker.c:592 #12 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14bdda22b0, p=0x7f13ba4ff660, slot=0x7f14b7795ce0) at tm-threads.c:117 #13 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14bdda22b0, s=0x7f14b7795ce0, p=0x7f13ba4ff660) at ./tm-threads.h:195 #14 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f13bffff680, pbd=0x7f0ec2a00000, ppd=0x7f0ec2a52918) at source-af-packet.c:983 #15 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f13bffff680, pbd=0x7f0ec2a00000) at source-af-packet.c:996 #16 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f13bffff680) at source-af-packet.c:1043 #17 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14bdda22b0, data=0x7f13bffff680, slot=0x7f14c0539430) at source-af-packet.c:1393 #18 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14bdda22b0) at tm-threads.c:312 #19 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #20 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 15 (Thread 0x7f12e975b700 (LWP 14039)): #0 0x0000000000590f6b in DetectEnginePktInspectionRun (tv=0x7f14a614b790, det_ctx=0x7f12a3882740, s=0x7f14c5b46610, f=0x7f075ce54ea0, p=0x7f12ae4ff660, alert_flags=0x7f12e975a6b7 "") at detect-engine.c:1811 #1 0x00000000006f6656 in DetectRulePacketRules (tv=0x7f14a614b790, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f12a3882740, p=0x7f12ae4ff660, pflow=0x7f075ce54ea0, scratch=0x7f12e975a730) at detect.c:798 #2 0x00000000006f5a8e in DetectRun (th_v=0x7f14a614b790, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f12a3882740, p=0x7f12ae4ff660) at detect.c:136 #3 0x00000000006f576f in DetectFlow (tv=0x7f14a614b790, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f12a3882740, p=0x7f12ae4ff660) at detect.c:1683 #4 0x00000000006f5618 in Detect (tv=0x7f14a614b790, p=0x7f12ae4ff660, data=0x7f12a3882740) at detect.c:1755 #5 0x0000000000615618 in FlowWorker (tv=0x7f14a614b790, p=0x7f12ae4ff660, data=0x7f12ae53b0f0) at flow-worker.c:552 #6 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14a614b790, p=0x7f12ae4ff660, slot=0x7f14bb393490) at tm-threads.c:117 #7 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14a614b790, s=0x7f14bb393490, p=0x7f12ae4ff660) at ./tm-threads.h:195 #8 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f12b7fff680, pbd=0x7f0cf1c00000, ppd=0x7f0cf1c55778) at source-af-packet.c:983 #9 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f12b7fff680, pbd=0x7f0cf1c00000) at source-af-packet.c:996 #10 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f12b7fff680) at source-af-packet.c:1043 #11 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14a614b790, data=0x7f12b7fff680, slot=0x7f14c2b475d0) at source-af-packet.c:1393 #12 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14a614b790) at tm-threads.c:312 #13 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 14 (Thread 0x7f145fa74700 (LWP 14014)): #0 0x00000000006f8114 in DetectPrefilterMergeSort (de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1447882740) at detect.c:359 #1 0x00000000006f63ef in DetectRunPrefilterPkt (tv=0x7f149974d640, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1447882740, p=0x7f14524ff660, scratch=0x7f145fa73730) at detect.c:697 #2 0x00000000006f5a71 in DetectRun (th_v=0x7f149974d640, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1447882740, p=0x7f14524ff660) at detect.c:132 #3 0x00000000006f576f in DetectFlow (tv=0x7f149974d640, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1447882740, p=0x7f14524ff660) at detect.c:1683 #4 0x00000000006f5618 in Detect (tv=0x7f149974d640, p=0x7f14524ff660, data=0x7f1447882740) at detect.c:1755 #5 0x0000000000615618 in FlowWorker (tv=0x7f149974d640, p=0x7f14524ff660, data=0x7f145253b0f0) at flow-worker.c:552 #6 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f149974d640, p=0x7f14524ff660, slot=0x7f14c27dfe80) at tm-threads.c:117 #7 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f149974d640, s=0x7f14c27dfe80, p=0x7f14524ff660) at ./tm-threads.h:195 #8 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f1457fff680, pbd=0x7f0fb3200000, ppd=0x7f0fb323b100) at source-af-packet.c:983 #9 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f1457fff680, pbd=0x7f0fb3200000) at source-af-packet.c:996 #10 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f1457fff680) at source-af-packet.c:1043 #11 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f149974d640, data=0x7f1457fff680, slot=0x7f14c27d6740) at source-af-packet.c:1393 #12 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f149974d640) at tm-threads.c:312 #13 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 13 (Thread 0x7f10cece8700 (LWP 14070)): #0 0x0000000000615d34 in FlowWorkerProcessInjectedFlows (tv=0x7f14c2baac80, fw=0x7f10b253b0f0, p=0x7f10b24ff660, detect_thread=0x7f10a7882740) at flow-worker.c:454 #1 0x0000000000615787 in FlowWorker (tv=0x7f14c2baac80, p=0x7f10b24ff660, data=0x7f10b253b0f0) at flow-worker.c:592 #2 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14c2baac80, p=0x7f10b24ff660, slot=0x7f14c2daad80) at tm-threads.c:117 #3 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14c2baac80, s=0x7f14c2daad80, p=0x7f10b24ff660) at ./tm-threads.h:195 #4 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f10bbfff680, pbd=0x7f0984c00000, ppd=0x7f0984c1c400) at source-af-packet.c:983 #5 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f10bbfff680, pbd=0x7f0984c00000) at source-af-packet.c:996 #6 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f10bbfff680) at source-af-packet.c:1043 #7 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14c2baac80, data=0x7f10bbfff680, slot=0x7f14c0d3ddf0) at source-af-packet.c:1393 #8 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14c2baac80) at tm-threads.c:312 #9 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #10 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 12 (Thread 0x7f141a4e7700 (LWP 14020)): #0 0x0000000000590fea in DetectEnginePktInspectionRun (tv=0x7f14bdd88dc0, det_ctx=0x7f13e3882740, s=0x7f14c5afe400, f=0x7ef8766356b0, p=0x7f13ee4ff660, alert_flags=0x7f141a4e66b7 "") at detect-engine.c:1821 #1 0x00000000006f6656 in DetectRulePacketRules (tv=0x7f14bdd88dc0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f13e3882740, p=0x7f13ee4ff660, pflow=0x7ef8766356b0, scratch=0x7f141a4e6730) at detect.c:798 #2 0x00000000006f5a8e in DetectRun (th_v=0x7f14bdd88dc0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f13e3882740, p=0x7f13ee4ff660) at detect.c:136 #3 0x00000000006f576f in DetectFlow (tv=0x7f14bdd88dc0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f13e3882740, p=0x7f13ee4ff660) at detect.c:1683 #4 0x00000000006f5618 in Detect (tv=0x7f14bdd88dc0, p=0x7f13ee4ff660, data=0x7f13e3882740) at detect.c:1755 #5 0x0000000000615618 in FlowWorker (tv=0x7f14bdd88dc0, p=0x7f13ee4ff660, data=0x7f13ee53b0f0) at flow-worker.c:552 #6 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14bdd88dc0, p=0x7f13ee4ff660, slot=0x7f14a4174360) at tm-threads.c:117 #7 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14bdd88dc0, s=0x7f14a4174360, p=0x7f13ee4ff660) at ./tm-threads.h:195 #8 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f13f7fff680, pbd=0x7f0f11e00000, ppd=0x7f0f11e9c520) at source-af-packet.c:983 #9 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f13f7fff680, pbd=0x7f0f11e00000) at source-af-packet.c:996 #10 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f13f7fff680) at source-af-packet.c:1043 #11 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14bdd88dc0, data=0x7f13f7fff680, slot=0x7f14a89e6490) at source-af-packet.c:1393 #12 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14bdd88dc0) at tm-threads.c:312 #13 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 11 (Thread 0x7f141bfff700 (LWP 14018)): #0 0x00007f1638a52469 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007f16388f2c25 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x00007f16389dd52a in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #3 0x00007f16388e147b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #4 0x0000000000526a16 in SCHSSearch (mpm_ctx=0x7f14a259dc90, mpm_thread_ctx=0x7f1403882828, pmq=0x7f1403882858, buf=0x7f0f4ee18d9c , buflen=128) at util-mpm-hs.c:946 #5 0x00000000005a6008 in PrefilterPktPayload (det_ctx=0x7f1403882740, p=0x7f140e4ff660, pectx=0x7f14a259dc90) at detect-engine-payload.c:122 #6 0x00000000005a978c in Prefilter (det_ctx=0x7f1403882740, sgh=0x7f14a2291fd0, p=0x7f140e4ff660, flags=4 '\004') at detect-engine-prefilter.c:182 #7 0x00000000006f63c0 in DetectRunPrefilterPkt (tv=0x7f14bdd7a720, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1403882740, p=0x7f140e4ff660, scratch=0x7f141bffe730) at detect.c:688 #8 0x00000000006f5a71 in DetectRun (th_v=0x7f14bdd7a720, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1403882740, p=0x7f140e4ff660) at detect.c:132 #9 0x00000000006f576f in DetectFlow (tv=0x7f14bdd7a720, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1403882740, p=0x7f140e4ff660) at detect.c:1683 #10 0x00000000006f5618 in Detect (tv=0x7f14bdd7a720, p=0x7f140e4ff660, data=0x7f1403882740) at detect.c:1755 #11 0x0000000000615618 in FlowWorker (tv=0x7f14bdd7a720, p=0x7f140e4ff660, data=0x7f140e53b0f0) at flow-worker.c:552 #12 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14bdd7a720, p=0x7f140e4ff660, slot=0x7f14b7807d80) at tm-threads.c:117 #13 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14bdd7a720, s=0x7f14b7807d80, p=0x7f140e4ff660) at ./tm-threads.h:195 #14 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f1413fff680, pbd=0x7f0f4ee00000, ppd=0x7f0f4ee18d18) at source-af-packet.c:983 #15 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f1413fff680, pbd=0x7f0f4ee00000) at source-af-packet.c:996 #16 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f1413fff680) at source-af-packet.c:1043 #17 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14bdd7a720, data=0x7f1413fff680, slot=0x7f14a868e210) at source-af-packet.c:1393 #18 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14bdd7a720) at tm-threads.c:312 #19 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #20 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 10 (Thread 0x7f11fece8700 (LWP 14052)): #0 0x00007f1638c0dfc7 in __GI___pthread_mutex_lock (mutex=0x7f1622ba57d0) at ../nptl/pthread_mutex_lock.c:67 #1 0x000000000060cb3e in FromHashLockBucket (fb=0x7f1622ba57c0) at flow-hash.c:727 #2 0x000000000060c71c in FlowGetFlowFromHash (tv=0x7f14c2c274d0, fls=0x7f11e253b138, p=0x7f11e24ff660, dest=0x7f11e24ff698) at flow-hash.c:763 #3 0x0000000000609dc2 in FlowHandlePacket (tv=0x7f14c2c274d0, fls=0x7f11e253b138, p=0x7f11e24ff660) at flow.c:512 #4 0x000000000061545a in FlowWorker (tv=0x7f14c2c274d0, p=0x7f11e24ff660, data=0x7f11e253b0f0) at flow-worker.c:502 #5 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14c2c274d0, p=0x7f11e24ff660, slot=0x7f14b784c710) at tm-threads.c:117 #6 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14c2c274d0, s=0x7f14b784c710, p=0x7f11e24ff660) at ./tm-threads.h:195 #7 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f11ebfff680, pbd=0x7f0b8da00000, ppd=0x7f0b8daa3468) at source-af-packet.c:983 #8 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f11ebfff680, pbd=0x7f0b8da00000) at source-af-packet.c:996 #9 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f11ebfff680) at source-af-packet.c:1043 #10 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14c2c274d0, data=0x7f11ebfff680, slot=0x7f14af804e30) at source-af-packet.c:1393 #11 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14c2c274d0) at tm-threads.c:312 #12 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #13 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 9 (Thread 0x7f11209cf700 (LWP 14068)): #0 0x00000000006f64d5 in DetectRulePacketRules (tv=0x7f14c2b5b4a0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f10cb882740, p=0x7f10d64ff660, pflow=0x7f0414c3d820, scratch=0x7f11209ce730) at detect.c:756 #1 0x00000000006f5a8e in DetectRun (th_v=0x7f14c2b5b4a0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f10cb882740, p=0x7f10d64ff660) at detect.c:136 #2 0x00000000006f576f in DetectFlow (tv=0x7f14c2b5b4a0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f10cb882740, p=0x7f10d64ff660) at detect.c:1683 #3 0x00000000006f5618 in Detect (tv=0x7f14c2b5b4a0, p=0x7f10d64ff660, data=0x7f10cb882740) at detect.c:1755 #4 0x0000000000615618 in FlowWorker (tv=0x7f14c2b5b4a0, p=0x7f10d64ff660, data=0x7f10d653b0f0) at flow-worker.c:552 #5 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14c2b5b4a0, p=0x7f10d64ff660, slot=0x7f14b7a82cc0) at tm-threads.c:117 #6 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14c2b5b4a0, s=0x7f14b7a82cc0, p=0x7f10d64ff660) at ./tm-threads.h:195 #7 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f10dffff680, pbd=0x7f09cd600000, ppd=0x7f09cd627740) at source-af-packet.c:983 #8 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f10dffff680, pbd=0x7f09cd600000) at source-af-packet.c:996 #9 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f10dffff680) at source-af-packet.c:1043 #10 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14c2b5b4a0, data=0x7f10dffff680, slot=0x7f14c2dd8e30) at source-af-packet.c:1393 #11 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14c2b5b4a0) at tm-threads.c:312 #12 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #13 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 8 (Thread 0x7f13809cf700 (LWP 14031)): #0 0x00000000006f64d5 in DetectRulePacketRules (tv=0x7f14a6b3e2c0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f132b882740, p=0x7f13364ff660, pflow=0x7f14c8b31430, scratch=0x7f13809ce730) at detect.c:756 #1 0x00000000006f5a8e in DetectRun (th_v=0x7f14a6b3e2c0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f132b882740, p=0x7f13364ff660) at detect.c:136 #2 0x00000000006f576f in DetectFlow (tv=0x7f14a6b3e2c0, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f132b882740, p=0x7f13364ff660) at detect.c:1683 #3 0x00000000006f5618 in Detect (tv=0x7f14a6b3e2c0, p=0x7f13364ff660, data=0x7f132b882740) at detect.c:1755 #4 0x0000000000615618 in FlowWorker (tv=0x7f14a6b3e2c0, p=0x7f13364ff660, data=0x7f133653b0f0) at flow-worker.c:552 #5 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14a6b3e2c0, p=0x7f13364ff660, slot=0x7f14c06c91d0) at tm-threads.c:117 #6 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14a6b3e2c0, s=0x7f14c06c91d0, p=0x7f13364ff660) at ./tm-threads.h:195 #7 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f133ffff680, pbd=0x7f0de0a00000, ppd=0x7f0de0ad21f8) at source-af-packet.c:983 #8 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f133ffff680, pbd=0x7f0de0a00000) at source-af-packet.c:996 #9 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f133ffff680) at source-af-packet.c:1043 #10 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14a6b3e2c0, data=0x7f133ffff680, slot=0x7f14ab0dd1b0) at source-af-packet.c:1393 #11 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14a6b3e2c0) at tm-threads.c:312 #12 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #13 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 7 (Thread 0x7f10cdf5c700 (LWP 14071)): #0 0x00007f16389a627e in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #1 0x00007f16389dd5a5 in ?? () from /lib/x86_64-linux-gnu/libhs.so.5 #2 0x00007f16388e147b in avx512_hs_scan () from /lib/x86_64-linux-gnu/libhs.so.5 #3 0x0000000000526a16 in SCHSSearch (mpm_ctx=0x7f14a259dc90, mpm_thread_ctx=0x7f1097882828, pmq=0x7f1097882858, buf=0x7f0979247660 , buflen=1404) at util-mpm-hs.c:946 #4 0x00000000005a6008 in PrefilterPktPayload (det_ctx=0x7f1097882740, p=0x7f10a24ff660, pectx=0x7f14a259dc90) at detect-engine-payload.c:122 #5 0x00000000005a978c in Prefilter (det_ctx=0x7f1097882740, sgh=0x7f14a2291fd0, p=0x7f10a24ff660, flags=4 '\004') at detect-engine-prefilter.c:182 #6 0x00000000006f63c0 in DetectRunPrefilterPkt (tv=0x7f14c2951580, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1097882740, p=0x7f10a24ff660, scratch=0x7f10cdf5b730) at detect.c:688 #7 0x00000000006f5a71 in DetectRun (th_v=0x7f14c2951580, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1097882740, p=0x7f10a24ff660) at detect.c:132 #8 0x00000000006f576f in DetectFlow (tv=0x7f14c2951580, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f1097882740, p=0x7f10a24ff660) at detect.c:1683 #9 0x00000000006f5618 in Detect (tv=0x7f14c2951580, p=0x7f10a24ff660, data=0x7f1097882740) at detect.c:1755 #10 0x0000000000615618 in FlowWorker (tv=0x7f14c2951580, p=0x7f10a24ff660, data=0x7f10a253b0f0) at flow-worker.c:552 #11 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14c2951580, p=0x7f10a24ff660, slot=0x7f14b1226e50) at tm-threads.c:117 #12 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14c2951580, s=0x7f14b1226e50, p=0x7f10a24ff660) at ./tm-threads.h:195 #13 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f10abfff680, pbd=0x7f0979200000, ppd=0x7f09792475e0) at source-af-packet.c:983 #14 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f10abfff680, pbd=0x7f0979200000) at source-af-packet.c:996 #15 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f10abfff680) at source-af-packet.c:1043 #16 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14c2951580, data=0x7f10abfff680, slot=0x7f14bb89bca0) at source-af-packet.c:1393 #17 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14c2951580) at tm-threads.c:312 #18 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #19 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 6 (Thread 0x7f1253fff700 (LWP 14046)): #0 0x00000000006f7ca2 in DetectPrefilterBuildNonPrefilterList (det_ctx=0x7f123b882740, mask=131 '\203', alproto=0 '\000') at detect.c:379 #1 0x00000000006f63a3 in DetectRunPrefilterPkt (tv=0x7f14af1aa380, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f123b882740, p=0x7f12464ff660, scratch=0x7f1253ffe730) at detect.c:683 #2 0x00000000006f5a71 in DetectRun (th_v=0x7f14af1aa380, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f123b882740, p=0x7f12464ff660) at detect.c:132 #3 0x00000000006f576f in DetectFlow (tv=0x7f14af1aa380, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f123b882740, p=0x7f12464ff660) at detect.c:1683 #4 0x00000000006f5618 in Detect (tv=0x7f14af1aa380, p=0x7f12464ff660, data=0x7f123b882740) at detect.c:1755 #5 0x0000000000615618 in FlowWorker (tv=0x7f14af1aa380, p=0x7f12464ff660, data=0x7f124653b0f0) at flow-worker.c:552 #6 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14af1aa380, p=0x7f12464ff660, slot=0x7f14b6e0f3f0) at tm-threads.c:117 #7 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14af1aa380, s=0x7f14b6e0f3f0, p=0x7f12464ff660) at ./tm-threads.h:195 #8 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f124bfff680, pbd=0x7f0c3a000000, ppd=0x7f0c3a0ad0e0) at source-af-packet.c:983 #9 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f124bfff680, pbd=0x7f0c3a000000) at source-af-packet.c:996 #10 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f124bfff680) at source-af-packet.c:1043 #11 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14af1aa380, data=0x7f124bfff680, slot=0x7f14c0950c90) at source-af-packet.c:1393 #12 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14af1aa380) at tm-threads.c:312 #13 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 5 (Thread 0x7f14189cf700 (LWP 14022)): #0 0x00000000005a94e1 in DetectRunPrefilterTx (det_ctx=0x7f13c3882740, sgh=0x7f14a22abb50, p=0x7f13ce4ff660, ipproto=6 '\006', flow_flags=8 '\b', alproto=8, alstate=0x7efa065be580, tx=0x7f14189ce620) at detect-engine-prefilter.c:129 #1 0x00000000006f6e6e in DetectRunTx (tv=0x7f14bdd93080, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f13c3882740, p=0x7f13ce4ff660, f=0x7ef73e8f6260, scratch=0x7f14189ce730) at detect.c:1330 #2 0x00000000006f5b96 in DetectRun (th_v=0x7f14bdd93080, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f13c3882740, p=0x7f13ce4ff660) at detect.c:153 #3 0x00000000006f576f in DetectFlow (tv=0x7f14bdd93080, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f13c3882740, p=0x7f13ce4ff660) at detect.c:1683 #4 0x00000000006f5618 in Detect (tv=0x7f14bdd93080, p=0x7f13ce4ff660, data=0x7f13c3882740) at detect.c:1755 #5 0x0000000000615618 in FlowWorker (tv=0x7f14bdd93080, p=0x7f13ce4ff660, data=0x7f13ce53b0f0) at flow-worker.c:552 #6 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14bdd93080, p=0x7f13ce4ff660, slot=0x7f14a7fdf4d0) at tm-threads.c:117 #7 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14bdd93080, s=0x7f14a7fdf4d0, p=0x7f13ce4ff660) at ./tm-threads.h:195 #8 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f13d7fff680, pbd=0x7f0ed0800000, ppd=0x7f0ed080ded0) at source-af-packet.c:983 #9 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f13d7fff680, pbd=0x7f0ed0800000) at source-af-packet.c:996 #10 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f13d7fff680) at source-af-packet.c:1043 #11 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14bdd93080, data=0x7f13d7fff680, slot=0x7f14c0367620) at source-af-packet.c:1393 #12 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14bdd93080) at tm-threads.c:312 #13 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 4 (Thread 0x7f1637d2da80 (LWP 13999)): #0 0x00007f16380323bf in __GI___clock_nanosleep (clock_id=clock_id@entry=0, flags=flags@entry=0, req=req@entry=0x7fff78e770d0, rem=rem@entry=0x0) at ../sysdeps/unix/sysv/linux/clock_nanosleep.c:78 #1 0x00007f1638038047 in __GI___nanosleep (requested_time=requested_time@entry=0x7fff78e770d0, remaining=remaining@entry=0x0) at nanosleep.c:27 #2 0x00007f163806a9bf in usleep (useconds=) at ../sysdeps/posix/usleep.c:32 #3 0x0000000000500898 in SuricataMainLoop (suri=0xd33f28 ) at suricata.c:2779 #4 0x00000000004fd8c7 in SuricataMain (argc=7, argv=0x7fff78e77298) at suricata.c:2948 #5 0x00000000004fbd42 in main (argc=7, argv=0x7fff78e77298) at main.c:22 Thread 3 (Thread 0x7f11651d0700 (LWP 14063)): #0 0x000000000060ced0 in FlowIsTimedOut (f=0x7f06b84a4100, sec=1645712553, emerg=false) at flow-hash.c:721 #1 0x000000000060c87c in FlowGetFlowFromHash (tv=0x7f14c5002ed0, fls=0x7f112a53b138, p=0x7f112a4ff660, dest=0x7f112a4ff698) at flow-hash.c:798 #2 0x0000000000609dc2 in FlowHandlePacket (tv=0x7f14c5002ed0, fls=0x7f112a53b138, p=0x7f112a4ff660) at flow.c:512 #3 0x000000000061545a in FlowWorker (tv=0x7f14c5002ed0, p=0x7f112a4ff660, data=0x7f112a53b0f0) at flow-worker.c:502 #4 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14c5002ed0, p=0x7f112a4ff660, slot=0x7f14c2e883b0) at tm-threads.c:117 #5 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14c5002ed0, s=0x7f14c2e883b0, p=0x7f112a4ff660) at ./tm-threads.h:195 #6 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f1133fff680, pbd=0x7f0a5a400000, ppd=0x7f0a5a404290) at source-af-packet.c:983 #7 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f1133fff680, pbd=0x7f0a5a400000) at source-af-packet.c:996 #8 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f1133fff680) at source-af-packet.c:1043 #9 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14c5002ed0, data=0x7f1133fff680, slot=0x7f14c2e8ac00) at source-af-packet.c:1393 #10 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14c5002ed0) at tm-threads.c:312 #11 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #12 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 2 (Thread 0x7f12509cf700 (LWP 14050)): #0 DetectEnginePktInspectionRun (tv=0x7f14c2e75e80, det_ctx=0x7f11fb882740, s=0x7f14c5b18760, f=0x7f06c1d64ab0, p=0x7f12064ff660, alert_flags=0x7f12509ce6b7 "") at detect-engine.c:1821 #1 0x00000000006f6656 in DetectRulePacketRules (tv=0x7f14c2e75e80, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f11fb882740, p=0x7f12064ff660, pflow=0x7f06c1d64ab0, scratch=0x7f12509ce730) at detect.c:798 #2 0x00000000006f5a8e in DetectRun (th_v=0x7f14c2e75e80, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f11fb882740, p=0x7f12064ff660) at detect.c:136 #3 0x00000000006f576f in DetectFlow (tv=0x7f14c2e75e80, de_ctx=0x7f14c5c7fe50, det_ctx=0x7f11fb882740, p=0x7f12064ff660) at detect.c:1683 #4 0x00000000006f5618 in Detect (tv=0x7f14c2e75e80, p=0x7f12064ff660, data=0x7f11fb882740) at detect.c:1755 #5 0x0000000000615618 in FlowWorker (tv=0x7f14c2e75e80, p=0x7f12064ff660, data=0x7f120653b0f0) at flow-worker.c:552 #6 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14c2e75e80, p=0x7f12064ff660, slot=0x7f14a42cbb50) at tm-threads.c:117 #7 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14c2e75e80, s=0x7f14a42cbb50, p=0x7f12064ff660) at ./tm-threads.h:195 #8 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f120ffff680, pbd=0x7f0bd5200000, ppd=0x7f0bd5214010) at source-af-packet.c:983 #9 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f120ffff680, pbd=0x7f0bd5200000) at source-af-packet.c:996 #10 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f120ffff680) at source-af-packet.c:1043 #11 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14c2e75e80, data=0x7f120ffff680, slot=0x7f14b7a2cc10) at source-af-packet.c:1393 #12 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14c2e75e80) at tm-threads.c:312 #13 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #14 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Thread 1 (Thread 0x7f12ea4e7700 (LWP 14038)): #0 0x000000000054efe5 in HttpRangeClose (c=0x7efbb62a92e0, flags=0) at app-layer-htp-range.c:530 #1 0x000000000054bee2 in HTPFileCloseHandleRange (files=0x7f12b22cbd80, flags=0, c=0x7efbb62a92e0, data=0x0, data_len=0) at app-layer-htp-file.c:360 #2 0x000000000054c060 in HTPFileClose (s=0x7f012d2c62c0, data=0x0, data_len=0, flags=0 '\000', direction=8 '\b') at app-layer-htp-file.c:418 #3 0x0000000000547e2b in HTPCallbackResponseComplete (tx=0x7efa4e9f99d0) at app-layer-htp.c:2261 #4 0x00007f1638e66b71 in htp_hook_run_all (hook=0x1222340, user_data=0x7efa4e9f99d0) at htp_hooks.c:127 #5 0x00007f1638e6f23b in htp_tx_state_response_complete_ex (tx=0x7efa4e9f99d0, hybrid_mode=0) at htp_transaction.c:1219 #6 0x00007f1638e6ca5a in htp_connp_res_data (connp=0x7f012ecd7f20, timestamp=, data=, len=) at htp_response.c:1321 #7 0x00000000005469a1 in HTPHandleResponseData (f=0x7ef0b1349250, htp_state=0x7f012d2c62c0, pstate=0x7efa4e363320, stream_slice=..., local_data=0x0) at app-layer-htp.c:944 #8 0x0000000000552865 in AppLayerParserParse (tv=0x7f14a68e8dd0, alp_tctx=0x7f12be59db30, f=0x7ef0b1349250, alproto=1, flags=26 '\032', input=0x0, input_len=870) at app-layer-parser.c:1309 #9 0x000000000053807c in AppLayerHandleTCPData (tv=0x7f14a68e8dd0, ra_ctx=0x7f12be573c30, p=0x7f12be4fc2d0, f=0x7ef0b1349250, ssn=0x7f12bf9d3e70, stream=0x7f12ea4e6530, data=0x0, data_len=870, flags=26 '\032') at app-layer.c:673 #10 0x000000000067eebf in ReassembleUpdateAppLayer (tv=0x7f14a68e8dd0, ra_ctx=0x7f12be573c30, ssn=0x7f12bf9d3e70, stream=0x7f12ea4e6530, p=0x7f12be4fc2d0, dir=UPDATE_DIR_PACKET) at stream-tcp-reassemble.c:1133 #11 0x000000000067ebb0 in StreamTcpReassembleAppLayer (tv=0x7f14a68e8dd0, ra_ctx=0x7f12be573c30, ssn=0x7f12bf9d3e70, stream=0x7f12bf9d3e80, p=0x7f12be4fc2d0, dir=UPDATE_DIR_PACKET) at stream-tcp-reassemble.c:1264 #12 0x00000000006808f7 in StreamTcpReassembleHandleSegment (tv=0x7f14a68e8dd0, ra_ctx=0x7f12be573c30, ssn=0x7f12bf9d3e70, stream=0x7f12bf9d3e80, p=0x7f12be4fc2d0, pq=0x7f12be53b120) at stream-tcp-reassemble.c:1934 #13 0x0000000000665142 in StreamTcpPacket (tv=0x7f14a68e8dd0, p=0x7f12be4fc2d0, stt=0x7f12c7fffc70, pq=0x7f12be53b120) at stream-tcp.c:4928 #14 0x0000000000667aa6 in StreamTcp (tv=0x7f14a68e8dd0, p=0x7f12be4fc2d0, data=0x7f12c7fffc70, pq=0x7f12be53b120) at stream-tcp.c:5304 #15 0x0000000000615aa3 in FlowWorkerStreamTCPUpdate (tv=0x7f14a68e8dd0, fw=0x7f12be53b0f0, p=0x7f12be4fc2d0, detect_thread=0x7f12b3882740, timeout=true) at flow-worker.c:370 #16 0x0000000000616328 in FlowWorkerFlowTimeout (tv=0x7f14a68e8dd0, p=0x7f12be4fc2d0, fw=0x7f12be53b0f0, detect_thread=0x7f12b3882740) at flow-worker.c:413 #17 0x00000000006162c8 in FlowFinish (tv=0x7f14a68e8dd0, f=0x7ef0b1349250, fw=0x7f12be53b0f0, detect_thread=0x7f12b3882740) at flow-worker.c:157 #18 0x0000000000615f7c in CheckWorkQueue (tv=0x7f14a68e8dd0, fw=0x7f12be53b0f0, detect_thread=0x7f12b3882740, counters=0x7f12ea4e67a8, fq=0x7f12ea4e67d0) at flow-worker.c:177 #19 0x0000000000615dc9 in FlowWorkerProcessInjectedFlows (tv=0x7f14a68e8dd0, fw=0x7f12be53b0f0, p=0x7f12be4ff660, detect_thread=0x7f12b3882740) at flow-worker.c:460 #20 0x0000000000615787 in FlowWorker (tv=0x7f14a68e8dd0, p=0x7f12be4ff660, data=0x7f12be53b0f0) at flow-worker.c:592 #21 0x0000000000504814 in TmThreadsSlotVarRun (tv=0x7f14a68e8dd0, p=0x7f12be4ff660, slot=0x7f14b74c2420) at tm-threads.c:117 #22 0x000000000065940e in TmThreadsSlotProcessPkt (tv=0x7f14a68e8dd0, s=0x7f14b74c2420, p=0x7f12be4ff660) at ./tm-threads.h:195 #23 0x0000000000659298 in AFPParsePacketV3 (ptv=0x7f12c7fff680, pbd=0x7f0d09800000, ppd=0x7f0d098228e0) at source-af-packet.c:983 #24 0x0000000000658f62 in AFPWalkBlock (ptv=0x7f12c7fff680, pbd=0x7f0d09800000) at source-af-packet.c:996 #25 0x0000000000657e0c in AFPReadFromRingV3 (ptv=0x7f12c7fff680) at source-af-packet.c:1043 #26 0x0000000000657262 in ReceiveAFPLoop (tv=0x7f14a68e8dd0, data=0x7f12c7fff680, slot=0x7f14b78861a0) at source-af-packet.c:1393 #27 0x00000000005099ca in TmThreadsSlotPktAcqLoop (td=0x7f14a68e8dd0) at tm-threads.c:312 #28 0x00007f1638c0b609 in start_thread (arg=) at pthread_create.c:477 #29 0x00007f1638074293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95