Crashes after a few minutes

[thefinn93]

Hi,
I've been playing with sngrep a bit on a test PBX, and I find that it crashes after being run for a few minutes. It's not a consistent amount of time, so I assume it's crashing when some data goes in or out and the parser fails. I'd love to be able to give more info, but i'm not really sure how to collect it. I have a pcap of it happening, but need to go through and scrub any passwords/private info out of it before posting. Anything else I should do?

[Kaian]

Hi @thefinn93 ,

What command line arguments are you using? I found some crashes while parsing some non-SIP packets.

[thefinn93]

no arguments

[Kaian]

As a temporal fix you can filter traffic by port (usually 5060), just to check that is not a problem with SIP packets.

sngrep port 5060

I think I can reproduce the problem. What version are you using? Binary or compiled?

Thanks a lot for the feedback!!

[thefinn93]

sngrep - 0.3.1
Copyright (C) 2013-2015 Irontec S.L.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
 * Compiled with OpenSSL support.
 * Compiled with Wide-character support.
 * Compiled with Perl Compatible regular expressions support.
 * Compiled with IPv6 support.

Binary from the debian (wheezy) packages. I'll see if it crashes when I use those arguments, so far it hasn't

[Kaian]

Okey, Thanks for the testing :)

I'll try to get a crashing pcap file to properly test the fixes.

[thefinn93]

Just confirming that that filter definitely fixes it. I left it running all night, has yet to crash.

[Kaian]

I still haven't make it crash, but most of the times it happened, was related with packets that are not SIP but still captured because no bpf filter was applied.

Beware! sngrep stores all packet payload in memory! It can eat all of it if letf alone!
That's why capture.limit setting exists (default to 50000 dialogs).

Thanks a lot for the feedback!