Suricata

Start command -

  # Thursday's run
  # af+ac+custom+spm-bm+full
  # verified
  /usr/local/bin/suricata -c /etc/suricata/test-yaml/suricata.yaml \
--pidfile /var/run/suricata.pid \
--af-packet=eth2 --af-packet=eth3 --af-packet=eth0 \
--set "af-packet.0.tpacket-v3=no" \
--set "mpm-algo=ac" --set "spm-algo=bm" --set "detect.profile=custom" \
--set "detect.custom-values.toclient-groups=700" \
--set "detect.custom-values.toserver-groups=1000" \
--set "detect.sgh-mpm-context=full" -vvv -D

root@suricata:~# suricata -V
This is Suricata version 4.0dev (rev bcfbb88)

[New LWP 23738]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

Core was generated by `/usr/local/bin/suricata -c /etc/suricata/yaml/suricata.yaml --pidfile /va'.
Program terminated with signal SIGABRT, Aborted.
#0  0x00007fac2d50f428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
54    ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
[Current thread is 1 (Thread 0x7fa6637fe700 (LWP 23806))]
(gdb) 
(gdb) 
(gdb) thread apply all bt

Thread 25 (Thread 0x7fa7a55e8700 (LWP 23738)):
#0  0x00007fac2d5d4b5d in poll () at ../sysdeps/unix/syscall-template.S:84
#1  0x0000000000561ce3 in poll (__timeout=100, __nfds=1, __fds=0x7fa7a55e6bb0) at /usr/include/x86_64-linux-gnu/bits/poll2.h:46
#2  ReceiveAFPLoop (tv=0x7faaee0374f0, data=0x7fa737fffd80, slot=<optimized out>) at source-af-packet.c:1452
#3  0x00000000005834fd in TmThreadsSlotPktAcqLoop (td=0x7faaee0374f0) at tm-threads.c:334
#4  0x00007fac2ea0e6ba in start_thread (arg=0x7fa7a55e8700) at pthread_create.c:333
#5  0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 24 (Thread 0x7fac30255940 (LWP 23652)):
#0  0x00007fac2d5a575d in nanosleep () at ../sysdeps/unix/syscall-template.S:84
#1  0x00007fac2d5d71a4 in usleep (useconds=useconds@entry=10000) at ../sysdeps/posix/usleep.c:32
#2  0x0000000000411303 in SuricataMainLoop (suri=<optimized out>) at suricata.c:2757
#3  main (argc=<optimized out>, argv=<optimized out>) at suricata.c:2869

Thread 23 (Thread 0x7fa7a45e6700 (LWP 23740)):
#0  0x00007fac2d5d4b5d in poll () at ../sysdeps/unix/syscall-template.S:84
#1  0x0000000000561ce3 in poll (__timeout=100, __nfds=1, __fds=0x7fa7a45e4bb0) at /usr/include/x86_64-linux-gnu/bits/poll2.h:46
#2  ReceiveAFPLoop (tv=0x7faafed3a560, data=0x7fa717fffd80, slot=<optimized out>) at source-af-packet.c:1452
#3  0x00000000005834fd in TmThreadsSlotPktAcqLoop (td=0x7faafed3a560) at tm-threads.c:334
#4  0x00007fac2ea0e6ba in start_thread (arg=0x7fa7a45e6700) at pthread_create.c:333
#5  0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 22 (Thread 0x7fa7af029700 (LWP 23736)):
#0  0x00007fac2d5d4b5d in poll () at ../sysdeps/unix/syscall-template.S:84
#1  0x0000000000561ce3 in poll (__timeout=100, __nfds=1, __fds=0x7fa7af027bb0) at /usr/include/x86_64-linux-gnu/bits/poll2.h:46
#2  ReceiveAFPLoop (tv=0x7faaa4f39920, data=0x7fa757fffd80, slot=<optimized out>) at source-af-packet.c:1452
#3  0x00000000005834fd in TmThreadsSlotPktAcqLoop (td=0x7faaa4f39920) at tm-threads.c:334
#4  0x00007fac2ea0e6ba in start_thread (arg=0x7fa7af029700) at pthread_create.c:333
#5  0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 21 (Thread 0x7fa627fff700 (LWP 23812)):
#0  0x00007fac2d5d69e3 in select () at ../sysdeps/unix/syscall-template.S:84
#1  0x0000000000589913 in UnixMain (this=this@entry=0x897d40 <command>) at unix-manager.c:565
#2  0x0000000000589b82 in UnixManager (th_v=0x7faa1d8393b0, thread_data=<optimized out>) at unix-manager.c:966
#3  0x00000000005840b3 in TmThreadsManagement (td=0x7faa1d8393b0) at tm-threads.c:709
#4  0x00007fac2ea0e6ba in start_thread (arg=0x7fa627fff700) at pthread_create.c:333
#5  0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 20 (Thread 0x7fa660ff9700 (LWP 23811)):
#0  pthread_cond_timedwait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_timedwait.S:225
#1  0x000000000046b8c2 in StatsMgmtThread (arg=0x7faa11a3bc20) at counters.c:378
#2  0x00007fac2ea0e6ba in start_thread (arg=0x7fa660ff9700) at pthread_create.c:333
#3  0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 19 (Thread 0x7fa661ffb700 (LWP 23809)):
#0  0x00007fac2d558450 in malloc_consolidate (av=av@entry=0x7fa740000020) at malloc.c:4167
#1  0x00007fac2d55a0a8 in _int_free (av=0x7fa740000020, p=<optimized out>, have_lock=0) at malloc.c:4073
#2  0x00007fac2d55d98c in __GI___libc_free (mem=<optimized out>) at malloc.c:2966
#3  0x0000000000453309 in HTPFree (ptr=<optimized out>, size=67488) at app-layer-htp-mem.c:159
---Type <return> to continue, or q <return> to quit--- 
#4  0x00000000005e7d26 in StreamingBufferClear (sb=sb@entry=0x7fa461e29f70) at util-streaming-buffer.c:78
#5  0x00000000005e7d4e in StreamingBufferFree (sb=0x7fa461e29f70) at util-streaming-buffer.c:87
#6  0x000000000044cebc in HtpBodyFree (body=<optimized out>) at app-layer-htp-body.c:170
#7  0x000000000044d1a7 in HtpTxUserDataFree (state=state@entry=0x7fa461e29c10, htud=0x7fa461e29c70) at app-layer-htp.c:309
#8  0x000000000044d2d8 in HTPStateFree (state=0x7fa461e29c10) at app-layer-htp.c:357
#9  0x0000000000457b10 in AppLayerParserStateCleanup (ipproto=<optimized out>, alproto=<optimized out>, alstate=0x7fa461e29c10, pstate=0x7fa461e2a700) at app-layer-parser.c:1190
#10 0x00000000004fdda1 in FlowCleanupAppLayer (f=f@entry=0x7fa16fd44700) at flow.c:97
#11 0x00000000004ff66e in FlowClearMemory (f=f@entry=0x7fa16fd44700, proto_map=<optimized out>) at flow.c:853
#12 0x000000000050151e in FlowRecycler (th_v=0x7fa9fef365f0, thread_data=0x7fa6280008c0) at flow-manager.c:935
#13 0x00000000005840b3 in TmThreadsManagement (td=0x7fa9fef365f0) at tm-threads.c:709
#14 0x00007fac2ea0e6ba in start_thread (arg=0x7fa661ffb700) at pthread_create.c:333
#15 0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 18 (Thread 0x7fa7a5de9700 (LWP 23737)):
#0  0x00007fac2d5d4b5d in poll () at ../sysdeps/unix/syscall-template.S:84
#1  0x0000000000561ce3 in poll (__timeout=100, __nfds=1, __fds=0x7fa7a5de7bb0) at /usr/include/x86_64-linux-gnu/bits/poll2.h:46
#2  ReceiveAFPLoop (tv=0x7faaec13cc30, data=0x7fa747fffd80, slot=<optimized out>) at source-af-packet.c:1452
#3  0x00000000005834fd in TmThreadsSlotPktAcqLoop (td=0x7faaec13cc30) at tm-threads.c:334
#4  0x00007fac2ea0e6ba in start_thread (arg=0x7fa7a5de9700) at pthread_create.c:333
#5  0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 17 (Thread 0x7fa6627fc700 (LWP 23808)):
#0  0x00007fac2d55991e in _int_free (av=0x7fa634000020, p=0x7fa634011140, have_lock=0) at malloc.c:3945
#1  0x00007fac2d55d98c in __GI___libc_free (mem=<optimized out>) at malloc.c:2966
#2  0x00007fac2ec2710d in ?? () from /usr/lib/x86_64-linux-gnu/libjansson.so.4
#3  0x00007fac2ec27629 in ?? () from /usr/lib/x86_64-linux-gnu/libjansson.so.4
#4  0x00007fac2ec2b8cd in json_object_clear () from /usr/lib/x86_64-linux-gnu/libjansson.so.4
#5  0x0000000000533776 in JsonFlowLogger (tv=<optimized out>, thread_data=0x7fa634000900, f=0x7fa16ea80090) at output-json-flow.c:359
#6  0x0000000000521cb6 in OutputFlowLog (tv=tv@entry=0x7fa9f6f3cbf0, thread_data=<optimized out>, f=f@entry=0x7fa16ea80090) at output-flow.c:112
#7  0x000000000050150f in FlowRecycler (th_v=0x7fa9f6f3cbf0, thread_data=0x7fa6340008c0) at flow-manager.c:933
#8  0x00000000005840b3 in TmThreadsManagement (td=0x7fa9f6f3cbf0) at tm-threads.c:709
#9  0x00007fac2ea0e6ba in start_thread (arg=0x7fa6627fc700) at pthread_create.c:333
#10 0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 16 (Thread 0x7fa662ffd700 (LWP 23807)):
#0  pthread_cond_timedwait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_timedwait.S:225
#1  0x0000000000501a4f in FlowManager (th_v=0x7fa9d9241c80, thread_data=<optimized out>) at flow-manager.c:790
#2  0x00000000005840b3 in TmThreadsManagement (td=0x7fa9d9241c80) at tm-threads.c:709
#3  0x00007fac2ea0e6ba in start_thread (arg=0x7fa662ffd700) at pthread_create.c:333
#4  0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 15 (Thread 0x7fa663fff700 (LWP 23805)):
#0  0x00007fac2d5d4b5d in poll () at ../sysdeps/unix/syscall-template.S:84
#1  0x0000000000561ce3 in poll (__timeout=100, __nfds=1, __fds=0x7fa663ffdbb0) at /usr/include/x86_64-linux-gnu/bits/poll2.h:46
#2  ReceiveAFPLoop (tv=0x7fa9c8444f00, data=0x7fa653fffd80, slot=<optimized out>) at source-af-packet.c:1452
#3  0x00000000005834fd in TmThreadsSlotPktAcqLoop (td=0x7fa9c8444f00) at tm-threads.c:334
#4  0x00007fac2ea0e6ba in start_thread (arg=0x7fa663fff700) at pthread_create.c:333
#5  0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 14 (Thread 0x7fa760a4b700 (LWP 23804)):
---Type <return> to continue, or q <return> to quit---
#0  DetectPortLookupGroup (dp=<optimized out>, port=25) at detect-engine-port.c:810
#1  0x0000000000483613 in SigMatchSignaturesGetSgh (de_ctx=de_ctx@entry=0x7fab09e37120, det_ctx=det_ctx@entry=0x7fa65f50d980, p=p@entry=0x7fa669eff1b0) at detect.c:625
#2  0x0000000000484055 in SigMatchSignatures (th_v=th_v@entry=0x7fa9c3843ca0, de_ctx=0x7fab09e37120, det_ctx=0x7fa65f50d980, p=p@entry=0x7fa669eff1b0) at detect.c:1131
#3  0x0000000000484c1e in DetectNoFlow (p=<optimized out>, det_ctx=<optimized out>, de_ctx=<optimized out>, tv=<optimized out>) at detect.c:1603
#4  Detect (tv=tv@entry=0x7fa9c3843ca0, p=p@entry=0x7fa669eff1b0, data=data@entry=0x7fa65f50d980, pq=pq@entry=0x0, postpq=postpq@entry=0x0) at detect.c:1663
#5  0x0000000000505005 in FlowWorker (tv=0x7fa9c3843ca0, p=0x7fa669eff1b0, data=0x7fa669f24c60, preq=0x7fab723456c0, unused=<optimized out>) at flow-worker.c:252
#6  0x0000000000582892 in TmThreadsSlotVarRun (tv=tv@entry=0x7fa9c3843ca0, p=p@entry=0x7fa669eff1b0, slot=slot@entry=0x7fab70145aa0) at tm-threads.c:130
#7  0x000000000055cb7e in TmThreadsSlotProcessPkt (p=0x7fa669eff1b0, s=0x7fab70145aa0, tv=0x7fa9c3843ca0) at tm-threads.h:148
#8  AFPParsePacketV3 (pbd=0x7fa4e2458000, ppd=0x7fa4e245ed20, ptv=0x7fa667fffd80) at source-af-packet.c:1036
#9  AFPWalkBlock (pbd=0x7fa4e2458000, ptv=0x7fa667fffd80) at source-af-packet.c:1051
#10 AFPReadFromRingV3 (ptv=ptv@entry=0x7fa667fffd80) at source-af-packet.c:1090
#11 0x0000000000562002 in ReceiveAFPLoop (tv=0x7fa9c3843ca0, data=0x7fa667fffd80, slot=<optimized out>) at source-af-packet.c:1479
#12 0x00000000005834fd in TmThreadsSlotPktAcqLoop (td=0x7fa9c3843ca0) at tm-threads.c:334
#13 0x00007fac2ea0e6ba in start_thread (arg=0x7fa760a4b700) at pthread_create.c:333
#14 0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 13 (Thread 0x7fa77fd2f700 (LWP 23767)):
#0  0x00007fac2d5d4b5d in poll () at ../sysdeps/unix/syscall-template.S:84
#1  0x0000000000561ce3 in poll (__timeout=100, __nfds=1, __fds=0x7fa77fd2dbb0) at /usr/include/x86_64-linux-gnu/bits/poll2.h:46
#2  ReceiveAFPLoop (tv=0x7fa9de537af0, data=0x7fa6e7fffd80, slot=<optimized out>) at source-af-packet.c:1452
#3  0x00000000005834fd in TmThreadsSlotPktAcqLoop (td=0x7fa9de537af0) at tm-threads.c:334
#4  0x00007fac2ea0e6ba in start_thread (arg=0x7fa77fd2f700) at pthread_create.c:333
#5  0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 12 (Thread 0x7fa6617fa700 (LWP 23810)):
#0  pthread_cond_timedwait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_timedwait.S:225
#1  0x000000000046aabf in StatsWakeupThread (arg=0x7faa0063d800) at counters.c:456
#2  0x00007fac2ea0e6ba in start_thread (arg=0x7fa6617fa700) at pthread_create.c:333
#3  0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 11 (Thread 0x7fa76224e700 (LWP 23801)):
#0  SigMatchSignaturesGetSmsg (flags=<optimized out>, p=0x7fa699eff1b0, f=0x7fa1883f4f30) at detect.c:674
#1  SigMatchSignatures (th_v=th_v@entry=0x7faac5745770, de_ctx=0x7fab09e37120, det_ctx=0x7fa68f50d980, p=p@entry=0x7fa699eff1b0) at detect.c:1068
#2  0x0000000000484c1e in DetectNoFlow (p=<optimized out>, det_ctx=<optimized out>, de_ctx=<optimized out>, tv=<optimized out>) at detect.c:1603
#3  Detect (tv=tv@entry=0x7faac5745770, p=p@entry=0x7fa699eff1b0, data=data@entry=0x7fa68f50d980, pq=pq@entry=0x0, postpq=postpq@entry=0x0) at detect.c:1663
#4  0x0000000000505005 in FlowWorker (tv=0x7faac5745770, p=0x7fa699eff1b0, data=0x7fa699f24c60, preq=0x7fab70d45d90, unused=<optimized out>) at flow-worker.c:252
#5  0x0000000000582892 in TmThreadsSlotVarRun (tv=tv@entry=0x7faac5745770, p=p@entry=0x7fa699eff1b0, slot=slot@entry=0x7fab71145d50) at tm-threads.c:130
#6  0x000000000055cb7e in TmThreadsSlotProcessPkt (p=0x7fa699eff1b0, s=0x7fab71145d50, tv=0x7faac5745770) at tm-threads.h:148
#7  AFPParsePacketV3 (pbd=0x7fa525480000, ppd=0x7fa525483c80, ptv=0x7fa697fffd80) at source-af-packet.c:1036
#8  AFPWalkBlock (pbd=0x7fa525480000, ptv=0x7fa697fffd80) at source-af-packet.c:1051
#9  AFPReadFromRingV3 (ptv=ptv@entry=0x7fa697fffd80) at source-af-packet.c:1090
#10 0x0000000000562002 in ReceiveAFPLoop (tv=0x7faac5745770, data=0x7fa697fffd80, slot=<optimized out>) at source-af-packet.c:1479
#11 0x00000000005834fd in TmThreadsSlotPktAcqLoop (td=0x7faac5745770) at tm-threads.c:334
#12 0x00007fac2ea0e6ba in start_thread (arg=0x7fa76224e700) at pthread_create.c:333
#13 0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 10 (Thread 0x7fa76124c700 (LWP 23803)):
#0  SCACTileSearchSmall256 (ctx=0x7faa3243fbd0, mpm_thread_ctx=<optimized out>, pmq=0x7fa66f50daa8, buf=0x7fa4ef0dc644 <error: Cannot access memory at address 0x7fa4ef0dc644>, 
    buflen=476) at util-mpm-ac-tile-small.c:72
#1  0x00000000004b4eb6 in Prefilter (det_ctx=det_ctx@entry=0x7fa66f50d980, sgh=0x7faaab544f50, p=p@entry=0x7fa679eff1b0, flags=flags@entry=36 '$', has_state=has_state@entry=0)
---Type <return> to continue, or q <return> to quit---
    at detect-engine-prefilter.c:174
#2  0x0000000000483c4e in SigMatchSignatures (th_v=th_v@entry=0x7fa9ac6429f0, de_ctx=0x7fab09e37120, det_ctx=0x7fa66f50d980, p=p@entry=0x7fa679eff1b0) at detect.c:1191
#3  0x0000000000484c1e in DetectNoFlow (p=<optimized out>, det_ctx=<optimized out>, de_ctx=<optimized out>, tv=<optimized out>) at detect.c:1603
#4  Detect (tv=tv@entry=0x7fa9ac6429f0, p=p@entry=0x7fa679eff1b0, data=data@entry=0x7fa66f50d980, pq=pq@entry=0x0, postpq=postpq@entry=0x0) at detect.c:1663
#5  0x0000000000505005 in FlowWorker (tv=0x7fa9ac6429f0, p=0x7fa679eff1b0, data=0x7fa679f24c60, preq=0x7fab707456c0, unused=<optimized out>) at flow-worker.c:252
#6  0x0000000000582892 in TmThreadsSlotVarRun (tv=tv@entry=0x7fa9ac6429f0, p=p@entry=0x7fa679eff1b0, slot=slot@entry=0x7fab70945a00) at tm-threads.c:130
#7  0x000000000055cb7e in TmThreadsSlotProcessPkt (p=0x7fa679eff1b0, s=0x7fab70945a00, tv=0x7fa9ac6429f0) at tm-threads.h:148
#8  AFPParsePacketV3 (pbd=0x7fa4ef0d8000, ppd=0x7fa4ef0dc5b0, ptv=0x7fa677fffd80) at source-af-packet.c:1036
#9  AFPWalkBlock (pbd=0x7fa4ef0d8000, ptv=0x7fa677fffd80) at source-af-packet.c:1051
#10 AFPReadFromRingV3 (ptv=ptv@entry=0x7fa677fffd80) at source-af-packet.c:1090
#11 0x0000000000562002 in ReceiveAFPLoop (tv=0x7fa9ac6429f0, data=0x7fa677fffd80, slot=<optimized out>) at source-af-packet.c:1479
#12 0x00000000005834fd in TmThreadsSlotPktAcqLoop (td=0x7fa9ac6429f0) at tm-threads.c:334
#13 0x00007fac2ea0e6ba in start_thread (arg=0x7fa76124c700) at pthread_create.c:333
#14 0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 9 (Thread 0x7fa761a4d700 (LWP 23802)):
#0  SCACTileSearchSmall256 (ctx=0x7fa9b0736340, mpm_thread_ctx=<optimized out>, pmq=0x7fa67f50daa8, buf=0x7fa50039f96c <error: Cannot access memory at address 0x7fa50039f96c>, 
    buflen=1448) at util-mpm-ac-tile-small.c:64
#1  0x00000000004b4eb6 in Prefilter (det_ctx=det_ctx@entry=0x7fa67f50d980, sgh=0x7faaabc42a70, p=p@entry=0x7fa689eff1b0, flags=flags@entry=8 '\b', has_state=has_state@entry=0)
    at detect-engine-prefilter.c:174
#2  0x0000000000483c4e in SigMatchSignatures (th_v=th_v@entry=0x7faac9544940, de_ctx=0x7fab09e37120, det_ctx=0x7fa67f50d980, p=p@entry=0x7fa689eff1b0) at detect.c:1191
#3  0x0000000000484c1e in DetectNoFlow (p=<optimized out>, det_ctx=<optimized out>, de_ctx=<optimized out>, tv=<optimized out>) at detect.c:1603
#4  Detect (tv=tv@entry=0x7faac9544940, p=p@entry=0x7fa689eff1b0, data=data@entry=0x7fa67f50d980, pq=pq@entry=0x0, postpq=postpq@entry=0x0) at detect.c:1663
#5  0x0000000000505005 in FlowWorker (tv=0x7faac9544940, p=0x7fa689eff1b0, data=0x7fa689f24c60, preq=0x7fab70545d90, unused=<optimized out>) at flow-worker.c:252
#6  0x0000000000582892 in TmThreadsSlotVarRun (tv=tv@entry=0x7faac9544940, p=p@entry=0x7fa689eff1b0, slot=slot@entry=0x7fab71345a00) at tm-threads.c:130
#7  0x000000000055cb7e in TmThreadsSlotProcessPkt (p=0x7fa689eff1b0, s=0x7fab71345a00, tv=0x7faac9544940) at tm-threads.h:148
#8  AFPParsePacketV3 (pbd=0x7fa500398000, ppd=0x7fa50039f8d8, ptv=0x7fa687fffd80) at source-af-packet.c:1036
#9  AFPWalkBlock (pbd=0x7fa500398000, ptv=0x7fa687fffd80) at source-af-packet.c:1051
#10 AFPReadFromRingV3 (ptv=ptv@entry=0x7fa687fffd80) at source-af-packet.c:1090
#11 0x0000000000562002 in ReceiveAFPLoop (tv=0x7faac9544940, data=0x7fa687fffd80, slot=<optimized out>) at source-af-packet.c:1479
#12 0x00000000005834fd in TmThreadsSlotPktAcqLoop (td=0x7faac9544940) at tm-threads.c:334
#13 0x00007fac2ea0e6ba in start_thread (arg=0x7fa761a4d700) at pthread_create.c:333
#14 0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 8 (Thread 0x7fa77e52c700 (LWP 23790)):
#0  QuickSortSigIntId (n=<optimized out>, sids=<optimized out>) at detect-engine-prefilter.c:77
#1  Prefilter (det_ctx=det_ctx@entry=0x7fa6af50d980, sgh=<optimized out>, p=p@entry=0x7fa6b9eff1b0, flags=flags@entry=4 '\004', has_state=has_state@entry=0)
    at detect-engine-prefilter.c:199
#2  0x0000000000483c4e in SigMatchSignatures (th_v=th_v@entry=0x7faa41737ec0, de_ctx=0x7fab09e37120, det_ctx=0x7fa6af50d980, p=p@entry=0x7fa6b9eff1b0) at detect.c:1191
#3  0x0000000000484c1e in DetectNoFlow (p=<optimized out>, det_ctx=<optimized out>, de_ctx=<optimized out>, tv=<optimized out>) at detect.c:1603
#4  Detect (tv=tv@entry=0x7faa41737ec0, p=p@entry=0x7fa6b9eff1b0, data=data@entry=0x7fa6af50d980, pq=pq@entry=0x0, postpq=postpq@entry=0x0) at detect.c:1663
#5  0x0000000000505005 in FlowWorker (tv=0x7faa41737ec0, p=0x7fa6b9eff1b0, data=0x7fa6b9f24c60, preq=0x7fab77745c80, unused=<optimized out>) at flow-worker.c:252
#6  0x0000000000582892 in TmThreadsSlotVarRun (tv=tv@entry=0x7faa41737ec0, p=p@entry=0x7fa6b9eff1b0, slot=slot@entry=0x7fab740457c0) at tm-threads.c:130
#7  0x000000000055cb7e in TmThreadsSlotProcessPkt (p=0x7fa6b9eff1b0, s=0x7fab740457c0, tv=0x7faa41737ec0) at tm-threads.h:148
#8  AFPParsePacketV3 (pbd=0x7fa54d0d8000, ppd=0x7fa54d0dd700, ptv=0x7fa6b7fffd80) at source-af-packet.c:1036
#9  AFPWalkBlock (pbd=0x7fa54d0d8000, ptv=0x7fa6b7fffd80) at source-af-packet.c:1051
#10 AFPReadFromRingV3 (ptv=ptv@entry=0x7fa6b7fffd80) at source-af-packet.c:1090
#11 0x0000000000562002 in ReceiveAFPLoop (tv=0x7faa41737ec0, data=0x7fa6b7fffd80, slot=<optimized out>) at source-af-packet.c:1479
#12 0x00000000005834fd in TmThreadsSlotPktAcqLoop (td=0x7faa41737ec0) at tm-threads.c:334
#13 0x00007fac2ea0e6ba in start_thread (arg=0x7fa77e52c700) at pthread_create.c:333
---Type <return> to continue, or q <return> to quit---
#14 0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 7 (Thread 0x7fa77dd2b700 (LWP 23793)):
#0  SCACTileSearchSmall256 (ctx=0x7faa0cd40d30, mpm_thread_ctx=<optimized out>, pmq=0x7fa69f50daa8, buf=0x7fa52c329bbc <error: Cannot access memory at address 0x7fa52c329bbc>, 
    buflen=1398) at util-mpm-ac-tile-small.c:79
#1  0x00000000004b4eb6 in Prefilter (det_ctx=det_ctx@entry=0x7fa69f50d980, sgh=0x7faaa973f8d0, p=p@entry=0x7fa6a9eff1b0, flags=flags@entry=52 '4', has_state=has_state@entry=0)
    at detect-engine-prefilter.c:174
#2  0x0000000000483c4e in SigMatchSignatures (th_v=th_v@entry=0x7fab97345b20, de_ctx=0x7fab09e37120, det_ctx=0x7fa69f50d980, p=p@entry=0x7fa6a9eff1b0) at detect.c:1191
#3  0x0000000000484c1e in DetectNoFlow (p=<optimized out>, det_ctx=<optimized out>, de_ctx=<optimized out>, tv=<optimized out>) at detect.c:1603
#4  Detect (tv=tv@entry=0x7fab97345b20, p=p@entry=0x7fa6a9eff1b0, data=data@entry=0x7fa69f50d980, pq=pq@entry=0x0, postpq=postpq@entry=0x0) at detect.c:1663
#5  0x0000000000505005 in FlowWorker (tv=0x7fab97345b20, p=0x7fa6a9eff1b0, data=0x7fa6a9f24c60, preq=0x7fab72e45d90, unused=<optimized out>) at flow-worker.c:252
#6  0x0000000000582892 in TmThreadsSlotVarRun (tv=tv@entry=0x7fab97345b20, p=p@entry=0x7fa6a9eff1b0, slot=slot@entry=0x7fab73e45400) at tm-threads.c:130
#7  0x000000000055cb7e in TmThreadsSlotProcessPkt (p=0x7fa6a9eff1b0, s=0x7fab73e45400, tv=0x7fab97345b20) at tm-threads.h:148
#8  AFPParsePacketV3 (pbd=0x7fa52c328000, ppd=0x7fa52c329b28, ptv=0x7fa6a7fffd80) at source-af-packet.c:1036
#9  AFPWalkBlock (pbd=0x7fa52c328000, ptv=0x7fa6a7fffd80) at source-af-packet.c:1051
#10 AFPReadFromRingV3 (ptv=ptv@entry=0x7fa6a7fffd80) at source-af-packet.c:1090
#11 0x0000000000562002 in ReceiveAFPLoop (tv=0x7fab97345b20, data=0x7fa6a7fffd80, slot=<optimized out>) at source-af-packet.c:1479
#12 0x00000000005834fd in TmThreadsSlotPktAcqLoop (td=0x7fab97345b20) at tm-threads.c:334
#13 0x00007fac2ea0e6ba in start_thread (arg=0x7fa77dd2b700) at pthread_create.c:333
#14 0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 6 (Thread 0x7fa7a4de7700 (LWP 23739)):
#0  0x00007fac2d5d4b5d in poll () at ../sysdeps/unix/syscall-template.S:84
#1  0x0000000000561ce3 in poll (__timeout=100, __nfds=1, __fds=0x7fa7a4de5bb0) at /usr/include/x86_64-linux-gnu/bits/poll2.h:46
#2  ReceiveAFPLoop (tv=0x7faaf5f44880, data=0x7fa727fffd80, slot=<optimized out>) at source-af-packet.c:1452
#3  0x00000000005834fd in TmThreadsSlotPktAcqLoop (td=0x7faaf5f44880) at tm-threads.c:334
#4  0x00007fac2ea0e6ba in start_thread (arg=0x7fa7a4de7700) at pthread_create.c:333
#5  0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 5 (Thread 0x7fa77ed2d700 (LWP 23789)):
#0  SCACTileSearchSmall256 (ctx=0x7faa3b63c2d0, mpm_thread_ctx=<optimized out>, pmq=0x7fa6bf50daa8, buf=0x7fa553b4c308 <error: Cannot access memory at address 0x7fa553b4c308>, 
    buflen=1380) at util-mpm-ac-tile-small.c:72
#1  0x00000000004b4eb6 in Prefilter (det_ctx=det_ctx@entry=0x7fa6bf50d980, sgh=0x7faaad93d0b0, p=p@entry=0x7fa6c9eff1b0, flags=flags@entry=4 '\004', has_state=has_state@entry=0)
    at detect-engine-prefilter.c:174
#2  0x0000000000483c4e in SigMatchSignatures (th_v=th_v@entry=0x7faa2243c6f0, de_ctx=0x7fab09e37120, det_ctx=0x7fa6bf50d980, p=p@entry=0x7fa6c9eff1b0) at detect.c:1191
#3  0x0000000000484c1e in DetectNoFlow (p=<optimized out>, det_ctx=<optimized out>, de_ctx=<optimized out>, tv=<optimized out>) at detect.c:1603
#4  Detect (tv=tv@entry=0x7faa2243c6f0, p=p@entry=0x7fa6c9eff1b0, data=data@entry=0x7fa6bf50d980, pq=pq@entry=0x0, postpq=postpq@entry=0x0) at detect.c:1663
#5  0x0000000000505005 in FlowWorker (tv=0x7faa2243c6f0, p=0x7fa6c9eff1b0, data=0x7fa6c9f24c60, preq=0x7fab74845440, unused=<optimized out>) at flow-worker.c:252
#6  0x0000000000582892 in TmThreadsSlotVarRun (tv=tv@entry=0x7faa2243c6f0, p=p@entry=0x7fa6c9eff1b0, slot=slot@entry=0x7fab74945500) at tm-threads.c:130
#7  0x000000000055cb7e in TmThreadsSlotProcessPkt (p=0x7fa6c9eff1b0, s=0x7fab74945500, tv=0x7faa2243c6f0) at tm-threads.h:148
#8  AFPParsePacketV3 (pbd=0x7fa553b48000, ppd=0x7fa553b4c280, ptv=0x7fa6c7fffd80) at source-af-packet.c:1036
#9  AFPWalkBlock (pbd=0x7fa553b48000, ptv=0x7fa6c7fffd80) at source-af-packet.c:1051
#10 AFPReadFromRingV3 (ptv=ptv@entry=0x7fa6c7fffd80) at source-af-packet.c:1090
#11 0x0000000000562002 in ReceiveAFPLoop (tv=0x7faa2243c6f0, data=0x7fa6c7fffd80, slot=<optimized out>) at source-af-packet.c:1479
#12 0x00000000005834fd in TmThreadsSlotPktAcqLoop (td=0x7faa2243c6f0) at tm-threads.c:334
#13 0x00007fac2ea0e6ba in start_thread (arg=0x7fa77ed2d700) at pthread_create.c:333
#14 0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 4 (Thread 0x7fa780530700 (LWP 23766)):
#0  SCACTileSearchSmall256 (ctx=0x7fa9abb3dc70, mpm_thread_ctx=<optimized out>, pmq=0x7fa6ef50daa8, buf=0x7fa59b4844ac <error: Cannot access memory at address 0x7fa59b4844ac>, 
---Type <return> to continue, or q <return> to quit---
    buflen=1298) at util-mpm-ac-tile-small.c:63
#1  0x00000000004b4eb6 in Prefilter (det_ctx=det_ctx@entry=0x7fa6ef50d980, sgh=0x7faaa8843ab0, p=p@entry=0x7fa6f9eff1b0, flags=flags@entry=40 '(', has_state=has_state@entry=0)
    at detect-engine-prefilter.c:174
#2  0x0000000000483c4e in SigMatchSignatures (th_v=th_v@entry=0x7fa9e75411b0, de_ctx=0x7fab09e37120, det_ctx=0x7fa6ef50d980, p=p@entry=0x7fa6f9eff1b0) at detect.c:1191
#3  0x0000000000484c1e in DetectNoFlow (p=<optimized out>, det_ctx=<optimized out>, de_ctx=<optimized out>, tv=<optimized out>) at detect.c:1603
#4  Detect (tv=tv@entry=0x7fa9e75411b0, p=p@entry=0x7fa6f9eff1b0, data=data@entry=0x7fa6ef50d980, pq=pq@entry=0x0, postpq=postpq@entry=0x0) at detect.c:1663
#5  0x0000000000505005 in FlowWorker (tv=0x7fa9e75411b0, p=0x7fa6f9eff1b0, data=0x7fa6f9f24c60, preq=0x7fab76145960, unused=<optimized out>) at flow-worker.c:252
#6  0x0000000000582892 in TmThreadsSlotVarRun (tv=tv@entry=0x7fa9e75411b0, p=p@entry=0x7fa6f9eff1b0, slot=slot@entry=0x7fab76745680) at tm-threads.c:130
#7  0x000000000055cb7e in TmThreadsSlotProcessPkt (p=0x7fa6f9eff1b0, s=0x7fab76745680, tv=0x7fa9e75411b0) at tm-threads.h:148
#8  AFPParsePacketV3 (pbd=0x7fa59b480000, ppd=0x7fa59b484418, ptv=0x7fa6f7fffd80) at source-af-packet.c:1036
#9  AFPWalkBlock (pbd=0x7fa59b480000, ptv=0x7fa6f7fffd80) at source-af-packet.c:1051
#10 AFPReadFromRingV3 (ptv=ptv@entry=0x7fa6f7fffd80) at source-af-packet.c:1090
#11 0x0000000000562002 in ReceiveAFPLoop (tv=0x7fa9e75411b0, data=0x7fa6f7fffd80, slot=<optimized out>) at source-af-packet.c:1479
#12 0x00000000005834fd in TmThreadsSlotPktAcqLoop (td=0x7fa9e75411b0) at tm-threads.c:334
#13 0x00007fac2ea0e6ba in start_thread (arg=0x7fa780530700) at pthread_create.c:333
#14 0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 3 (Thread 0x7fa780d31700 (LWP 23763)):
#0  0x00007fac2d5d4b5d in poll () at ../sysdeps/unix/syscall-template.S:84
#1  0x0000000000561ce3 in poll (__timeout=100, __nfds=1, __fds=0x7fa780d2fbb0) at /usr/include/x86_64-linux-gnu/bits/poll2.h:46
#2  ReceiveAFPLoop (tv=0x7fa9e6f45a70, data=0x7fa707fffd80, slot=<optimized out>) at source-af-packet.c:1452
#3  0x00000000005834fd in TmThreadsSlotPktAcqLoop (td=0x7fa9e6f45a70) at tm-threads.c:334
#4  0x00007fac2ea0e6ba in start_thread (arg=0x7fa780d31700) at pthread_create.c:333
#5  0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 2 (Thread 0x7fa77f52e700 (LWP 23776)):
#0  SCACTileSearchSmall256 (ctx=0x7fa9f0142f50, mpm_thread_ctx=<optimized out>, pmq=0x7fa6cf50daa8, buf=0x7fa567a9e074 <error: Cannot access memory at address 0x7fa567a9e074>, 
    buflen=1448) at util-mpm-ac-tile-small.c:79
#1  0x00000000004b4eb6 in Prefilter (det_ctx=det_ctx@entry=0x7fa6cf50d980, sgh=0x7faaac0434a0, p=p@entry=0x7fa6d9eff1b0, flags=flags@entry=36 '$', has_state=has_state@entry=0)
    at detect-engine-prefilter.c:174
#2  0x0000000000483c4e in SigMatchSignatures (th_v=th_v@entry=0x7faa0a5401a0, de_ctx=0x7fab09e37120, det_ctx=0x7fa6cf50d980, p=p@entry=0x7fa6d9eff1b0) at detect.c:1191
#3  0x0000000000484c1e in DetectNoFlow (p=<optimized out>, det_ctx=<optimized out>, de_ctx=<optimized out>, tv=<optimized out>) at detect.c:1603
#4  Detect (tv=tv@entry=0x7faa0a5401a0, p=p@entry=0x7fa6d9eff1b0, data=data@entry=0x7fa6cf50d980, pq=pq@entry=0x0, postpq=postpq@entry=0x0) at detect.c:1663
#5  0x0000000000505005 in FlowWorker (tv=0x7faa0a5401a0, p=0x7fa6d9eff1b0, data=0x7fa6d9f24c60, preq=0x7fab75645a80, unused=<optimized out>) at flow-worker.c:252
#6  0x0000000000582892 in TmThreadsSlotVarRun (tv=tv@entry=0x7faa0a5401a0, p=p@entry=0x7fa6d9eff1b0, slot=slot@entry=0x7fab75445d30) at tm-threads.c:130
#7  0x000000000055cb7e in TmThreadsSlotProcessPkt (p=0x7fa6d9eff1b0, s=0x7fab75445d30, tv=0x7faa0a5401a0) at tm-threads.h:148
#8  AFPParsePacketV3 (pbd=0x7fa567a98000, ppd=0x7fa567a9dfe0, ptv=0x7fa6d7fffd80) at source-af-packet.c:1036
#9  AFPWalkBlock (pbd=0x7fa567a98000, ptv=0x7fa6d7fffd80) at source-af-packet.c:1051
#10 AFPReadFromRingV3 (ptv=ptv@entry=0x7fa6d7fffd80) at source-af-packet.c:1090
#11 0x0000000000562002 in ReceiveAFPLoop (tv=0x7faa0a5401a0, data=0x7fa6d7fffd80, slot=<optimized out>) at source-af-packet.c:1479
#12 0x00000000005834fd in TmThreadsSlotPktAcqLoop (td=0x7faa0a5401a0) at tm-threads.c:334
#13 0x00007fac2ea0e6ba in start_thread (arg=0x7fa77f52e700) at pthread_create.c:333
#14 0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 1 (Thread 0x7fa6637fe700 (LWP 23806)):
#0  0x00007fac2d50f428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
#1  0x00007fac2d51102a in __GI_abort () at abort.c:89
#2  0x00007fac2d5517ea in __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x7fac2d66a2e0 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:175
#3  0x00007fac2d559e0a in malloc_printerr (ar_ptr=<optimized out>, ptr=<optimized out>, str=0x7fac2d66a410 "double free or corruption (!prev)", action=3) at malloc.c:5004
#4  _int_free (av=<optimized out>, p=<optimized out>, have_lock=0) at malloc.c:3865
---Type <return> to continue, or q <return> to quit---
#5  0x00007fac2d55d98c in __GI___libc_free (mem=mem@entry=0x1e274f0) at malloc.c:2966
#6  0x00007fac2d547363 in _IO_new_fclose (fp=0x1e274f0) at iofclose.c:84
#7  0x0000000000593825 in SCLogReopen (op_iface_ctx=0x1e27250, op_iface_ctx=0x1e27250) at util-debug.c:514
#8  SCLogMessage (log_level=log_level@entry=SC_LOG_INFO, file=file@entry=0x60db98 "flow-manager.c", line=line@entry=773, 
    function=function@entry=0x60e028 <__FUNCTION__.18428> "FlowManager", error_code=error_code@entry=SC_OK, 
    message=message@entry=0x7fa6637fcc90 "Flow emergency mode over, back to normal... unsetting FLOW_EMERGENCY bit (ts.tv_sec: 1491288829, ts.tv_usec:154623) flow_spare_q status(): 31% flows at the queue") at util-debug.c:577
#9  0x00000000005021fc in FlowManager (th_v=0x7fa9c8a43270, thread_data=<optimized out>) at flow-manager.c:769
#10 0x00000000005840b3 in TmThreadsManagement (td=0x7fa9c8a43270) at tm-threads.c:709
#11 0x00007fac2ea0e6ba in start_thread (arg=0x7fa6637fe700) at pthread_create.c:333
#12 0x00007fac2d5e082d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109