Suricata

Would you please attach the pcap?

Can you verify with 1.4.5 - there were similar bug fixes in the release:
http://suricata-ids.org/news/

thanks

I have run the provided pcap through the latest stable - 1.4.5
There is no issue/coredump

Peter,
I just installed 1.4.5 and WAS able to get the same core dump with the pcap file I uploaded.
I configured 1.4.5 as follows: ./configure --enable-unittests --enable-debug --enable-debug-validation
Then did a make and ran ./src/suricata

There is something different between 1.4.3 and 1.4.5 for this issue. For another pcap file (#0211 from Defcon 18 CTF) in version 1.4.3 I see an assertion failure for icmpv6 in 1.4.3 but in 1.4.5 for the same file there is an assertion for tcp.

1. suricata c /usr/local/etc/suricata/suricata.yaml -r /root/pcaps/defcon_18-ctf-0211.pcap
   11/8/2013 - 13:58:09 - <Info> - This is Suricata version 1.4.3 RELEASE
   11/8/2013 -- 13:58:09 - <Info> - CPUs/cores online: 2
   <snip>
   11/8/2013 -- 13:59:15 - <Info> - all 4 packet processing threads, 3 management threads initialized, engine started.
   suricata: detect.c:1760: Detect: Assertion `!((p)->icmpv6h ((void *)0))' failed.
   Aborted (core dumped)

BUT in the new version I see an assertion core for tcp:
[suricata-1.4.5]# ./src/suricata c /usr/local/etc/suricata/suricata.yaml -r /root/pcaps/defcon_18-ctf-0211.pcap
11/8/2013 - 13:51:50 - &lt;Info&gt; - This is Suricata version 1.4.5 RELEASE
11/8/2013 -- 13:51:50 - &lt;Info&gt; - CPUs/cores online: 2
&lt;snip&gt;
11/8/2013 -- 13:52:56 - &lt;Info&gt; - all 4 packet processing threads, 3 management threads initialized, engine started.
lt-suricata: detect.c:1764: Detect: Assertion `!((p)->tcph ((void *)0))' failed.
Aborted (core dumped)

Since I'm still seeing the issue with the pcap I uploaded even in the latest version, is there any other configuration information you'd like me to provide?

Defcon CTF pcaps can be downloaded using tor:
http://defcon.org/html/torrent/DEF%20CON%2019%20ctf.torrent
http://defcon.org/html/torrent/DEF%20CON%2018%20ctf.torrent

There are some interesting differences between the v1.4.3 and v1.4.5 failures on detect.c assertions.
Where 1.4.3 failed on ICMPv6 (or not at all) v1.4.5 is failing on TCP traffic.
If you are able to download the Defcon 18 files, I suggest looking at the 200's. 0211 and 204 specifically cause errors.

Is this still an issue with most recent suricata version?

Easy enough to validate I think Andreas.

Well I can't reproduce it thus I'm asking. But I should also mention that `/configure --enable-unittests --enable-debug --enable-debug-validation` isn't valid anymore.

Guess you forgot to mention that in your ticket update :)