Crashes after a few minutes about sngrep HOT 7 CLOSED

Hi @thefinn93 ,

What command line arguments are you using? I found some crashes while parsing some non-SIP packets.

from sngrep.

no arguments

from sngrep.

As a temporal fix you can filter traffic by port (usually 5060), just to check that is not a problem with SIP packets.

sngrep port 5060

I think I can reproduce the problem. What version are you using? Binary or compiled?

Thanks a lot for the feedback!!

from sngrep.

sngrep - 0.3.1
Copyright (C) 2013-2015 Irontec S.L.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
 * Compiled with OpenSSL support.
 * Compiled with Wide-character support.
 * Compiled with Perl Compatible regular expressions support.
 * Compiled with IPv6 support.

Binary from the debian (wheezy) packages. I'll see if it crashes when I use those arguments, so far it hasn't

from sngrep.

Okey, Thanks for the testing :)

I'll try to get a crashing pcap file to properly test the fixes.

from sngrep.

Just confirming that that filter definitely fixes it. I left it running all night, has yet to crash.

from sngrep.

I still haven't make it crash, but most of the times it happened, was related with packets that are not SIP but still captured because no bpf filter was applied.

Beware! sngrep stores all packet payload in memory! It can eat all of it if letf alone!
That's why capture.limit setting exists (default to 50000 dialogs).

Thanks a lot for the feedback!

from sngrep.