Skip to content

Packetbeat dies after ERR Dns ParseUdp #2872

Closed
@inqueue

Description

Packetbeat 5.0
Ubuntu 10.04

2016-10-27T11:03:57Z ERR Dns ParseUdp. Recovering, but please report this: runtime error: index out of range.
2016-10-27T11:03:57Z ERR Stacktrace: goroutine 16 [running]:
runtime/debug.Stack(0xb7ffb4, 0x2b, 0xc4220b6a00)
        /usr/local/go/src/runtime/debug/stack.go:24 +0x79
github.com/elastic/beats/libbeat/logp.Recover(0xb60e89, 0xc)
        /go/src/github.com/elastic/beats/libbeat/logp/log.go:114 +0x138
panic(0xa8f300, 0xc420014090)
        /usr/local/go/src/runtime/panic.go:458 +0x243
github.com/elastic/beats/packetbeat/protos/dns.rrsToMapStrs(0xc421779340, 0x7, 0x7, 0xc4220b6d70, 0xc4211cd6d8, 0x6)
        /go/src/github.com/elastic/beats/packetbeat/protos/dns/dns.go:549 +0x451
github.com/elastic/beats/packetbeat/protos/dns.addDnsToMapStr(0xc421d41ec0, 0xc4211e4360, 0xc4220b0101)
        /go/src/github.com/elastic/beats/packetbeat/protos/dns/dns.go:486 +0x908
github.com/elastic/beats/packetbeat/protos/dns.(*Dns).publishTransaction(0xc421314e00, 0xc421de3080)
        /go/src/github.com/elastic/beats/packetbeat/protos/dns/dns.go:386 +0xb77
github.com/elastic/beats/packetbeat/protos/dns.(*Dns).receivedDnsResponse(0xc421314e00, 0xc4220b7a28, 0xc421de1c80)
        /go/src/github.com/elastic/beats/packetbeat/protos/dns/dns.go:349 +0x272
github.com/elastic/beats/packetbeat/protos/dns.(*Dns).ParseUdp(0xc421314e00, 0xc421de1b00)
        /go/src/github.com/elastic/beats/packetbeat/protos/dns/dns_udp.go:39 +0x37c
github.com/elastic/beats/packetbeat/protos/udp.(*Udp).Process(0xc4211ec460, 0xc4200ceec0, 0xc421de1b00)
        /go/src/github.com/elastic/beats/packetbeat/protos/udp/udp.go:59 +0x293
github.com/elastic/beats/packetbeat/decoder.(*DecoderStruct).onUDP(0xc420096d00, 0xc421de1b00)
        /go/src/github.com/elastic/beats/packetbeat/decoder/decoder.go:295 +0xd9
github.com/elastic/beats/packetbeat/decoder.(*DecoderStruct).process(0xc420096d00, 0xc421de1b00, 0x2d, 0xff, 0x1100aa0, 0xc420096d00)
        /go/src/github.com/elastic/beats/packetbeat/decoder/decoder.go:253 +0x299
github.com/elastic/beats/packetbeat/decoder.(*DecoderStruct).OnPacket(0xc420096d00, 0xc4200dd1ac, 0xff, 0xff, 0xc421d41aa0)
        /go/src/github.com/elastic/beats/packetbeat/decoder/decoder.go:164 +0x343
github.com/elastic/beats/packetbeat/sniffer.(*SnifferSetup).Run(0xc42131e660, 0xbcd018, 0xc421236440)
        /go/src/github.com/elastic/beats/packetbeat/sniffer/sniffer.go:371 +0x493
github.com/elastic/beats/packetbeat/beater.(*Packetbeat).Run.func2(0xc421236440, 0xc4200dd400, 0xc4200d2e40)
        /go/src/github.com/elastic/beats/packetbeat/beater/packetbeat.go:155 +0x6a
created by github.com/elastic/beats/packetbeat/beater.(*Packetbeat).Run
        /go/src/github.com/elastic/beats/packetbeat/beater/packetbeat.go:159 +0x1b2

2016-10-27T11:04:08Z INFO Non-zero metrics in the last 30s: dns.unmatched_responses=1 libbeat.logstash.publish.read_bytes=594 libbeat.publisher.published_events=190 libbeat.logstash.call_count.PublishEvents=15 libbeat.logstash.publish.write_bytes=27641 libbeat.logstash.published_and_acked_events=187 libbeat.publisher.messages_in_worker_queues=40

It runs for a while until at some point, presumably, it comes across a DNS packet it does not like. I will work on getting a pcap.

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions