On 02/07/2014 04:24 PM, Mike Westmacott wrote:
Hi
I've found that due to the event handling netsniff-ng will not flush mmap
pcaps properly if receiving anything other than a sigint.
You can reproduce the problem with the following (start a new shell so no
other jobs are running - otherwise work out the correct pid for the
netsniff job)
sudo netsniff-ng -m -i eth0 -o test.pcap -s &
sudo kill 1
Then open in wireshark - it'll load ok but tell you it was truncated. Open
in your favourite hexeditor and you'll see zeroes at the end.
The cause of this is the signal handling mechanism:
static void signal_handler(int number)
{
switch (number) {
case SIGINT:
sigint = 1;
case SIGHUP:
default:
break;
}
}
This causes a problem in NSM and SecurityOnion as the nsm_sensor_ps-stop
and associated process libraries just use a 'kill $pid' to terminate.
Is there a plan for (re-)implementing daemonisation, or to handle all
signals?
Thanks for the report, we'll look into this and will come up with a fix.
cheers!
Mike
--
You received this message because you are subscribed to the Google Groups
"netsniff-ng" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
