<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2900.2873" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>I have a problem that I have been unsuccessful in
solve thus far with Stunnel, Snort, and MySQL.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Stunnel (client & server): 4.04</FONT></DIV>
<DIV><FONT face=Arial size=2>Snort: 2.4.4 on the client</FONT></DIV>
<DIV><FONT face=Arial size=2>MySQL Ver 11.18 Distrib 3.23.58, for
redhat-linux-gnu (i386) [not the latest and greatest by any means]</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>I setup stunnel so that traffic destined for
localhost 3306 (mysql) on the client goes to port 3307 on the server.
Stunnel on the server is setup to take traffic from 3307 and send it to 3306
locally. This connection works fine. I can fire up Snort and have
events properly log to my snort database on the server from the client.
However, if stunnel is stopped/restarted on either the client or the server
Snort is not able to keep writing to the database unless it is restarted.
I just get this error:</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>May 2 12:44:03 box snort[44126]:
database: Problem inserting a new signature 'Test Snort Signature'</FONT></DIV>
<DIV><FONT face=Arial size=2>May 2 12:44:03 box1 snort[44126]: database:
mysql_error: MySQL server has gone away SQL=INSERT INTO event
(sid,cid,signature,timestamp) VALUES ('4', '22', '0', '2006-05-02
16:44:03.322')<BR>May 2 12:44:03 box snort[44126]: database:
mysql_error: MySQL server has gone away SQL=ROLLBACK<BR></FONT></DIV>
<DIV><FONT face=Arial size=2>Whenever I close stunnel it sends traffic to the
other end. I can restart it and open up new connections just fine.
However, Snort will not even try and connect to port 3306. Once stunnel
has been stopped (or even restarted) it just immediately fails to even try and
connect to the port. It seems there's some kind of signal sent that kills
the connection (and all future connections?). I cannot figure oout why
this happens. Any ideas?</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Thanks</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Steven</DIV></FONT></BODY></HTML>