Hi Mike Thanks for your report.
On 2014-02-07 at 16:24:16 +0100, Mike Westmacott <[email protected]> wrote: > Hi > I've found that due to the event handling netsniff-ng will not flush mmap > pcaps properly if receiving anything other than a sigint. > You can reproduce the problem with the following (start a new shell so no > other jobs are running - otherwise work out the correct pid for the > netsniff job) > > sudo netsniff-ng -m -i eth0 -o test.pcap -s & > sudo kill 1 > > Then open in wireshark - it'll load ok but tell you it was truncated. Open > in your favourite hexeditor and you'll see zeroes at the end. > > The cause of this is the signal handling mechanism: > > > static void signal_handler(int number) > > > > { > > > > switch (number) { > > > > case SIGINT: > > > > sigint = 1; > > > > case SIGHUP: > > > > default: > > > > break; > > > > } > > > > } > > > > > This causes a problem in NSM and SecurityOnion as the nsm_sensor_ps-stop > and associated process libraries just use a 'kill $pid' to terminate. > > Is there a plan for (re-)implementing daemonisation, or to handle all > signals? The termination signals SIGTERM and SIGQUIT weren't handled properly in netsniff-ng. This is now fixed in the master branch of git://github.com/netsniff-ng/netsniff-ng.git in commit 064f4eddf1facae6eb50a7d928c6b049ee4231bf [1] [1] https://github.com/netsniff-ng/netsniff-ng/commit/064f4eddf1facae6eb50a7d928c6b049ee4231bf I successfully tested the fix against your test case. Can you verify that it now works for you as well? Cheers Tobias -- You received this message because you are subscribed to the Google Groups "netsniff-ng" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
