Hi
I've found that due to the event handling netsniff-ng will not flush mmap
pcaps properly if receiving anything other than a sigint.
You can reproduce the problem with the following (start a new shell so no
other jobs are running - otherwise work out the correct pid for the
netsniff job)
sudo netsniff-ng -m -i eth0 -o test.pcap -s &
sudo kill 1
Then open in wireshark - it'll load ok but tell you it was truncated. Open
in your favourite hexeditor and you'll see zeroes at the end.
The cause of this is the signal handling mechanism:
> static void signal_handler(int number)
>
> {
>
> switch (number) {
>
> case SIGINT:
>
> sigint = 1;
>
> case SIGHUP:
>
> default:
>
> break;
>
> }
>
> }
>
>
This causes a problem in NSM and SecurityOnion as the nsm_sensor_ps-stop
and associated process libraries just use a 'kill $pid' to terminate.
Is there a plan for (re-)implementing daemonisation, or to handle all
signals?
cheers!
Mike
--
You received this message because you are subscribed to the Google Groups
"netsniff-ng" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
