Information, Linux Distributions, OpenSourceSoftware, PADS, PRADS, Security, Sguil, Ubuntu

My version of pads-1.2-sguil-mods

Saturday 18 Jun 2005 Matthew J. Shelton released PADS. PADS is a great tool, and the security industry really needs a good open source passive asset tool. But since 2005, PADS development has stopped, and there are no place to send new signature or patches/bugs too, and hope that they will get added/fixed. Also, logical, there are no new features being added…

I have used PADS in my Sguil setup, but have seen that it lacks stuff that I wanted to have there, and also, there has been some problems running PADS on newer operation systems. I have a copy of the pads-1.2-sguil-mods.tar.gz, and I added it to github yesterday, fixed some issues when writing data to the FIFO file for Sguil, added some patches, among vorants vlan patch. I compiled it on Ubuntu Hardy and Jaunty (x86_64), and it has been running fine for 12+ hours.

If you try out my version of PADS and have issues, I will try to solve them. I see there are some, in stuff that I don’t use, and if I one day find the urge, I’ll fix them on my own.

I should probably also mention, shamelessly again, that there is a project that takes PADS to the next level and then some more….
You can read about PRADS here and what more it can do for you.


7 thoughts on “My version of pads-1.2-sguil-mods

  1. Erwinpdev says:

    I’ve tried the tar.gz version of PADS you offer on your site on 64 bit hardened Gentoo, but PADS segfaults when a service is detected with the following eror message in kern.log:

    Mar 22 01:15:09 dmz kernel: pads[12020]: segfault at 5990ca90 ip 00006b669cfcc391 sp 00007311f9c4e388 error 4 in[6b669cf50000+150000]
    Mar 22 01:15:09 dmz kernel: grsec: From signal 11 sent to /usr/bin/pads[pads:12020] uid/euid:103/103 gid/egid:1006/1006, parent /bin/bash[bash:32762] uid/euid:0/0 gid/egid:0/0

    The only thing I’ve changed is that I’ve applied the pads-ubuntu64b.patch from debian-pads.tgz manually to see if that would fix the problem. Except the 64 bit patch, is there any other difference between the tar.gz and git versions?

    The latest SVN version of the regular PADS does not seem to segfault, however although the SSH service I use for testing is detected and read by pads_agent, nothing is inserted in the sguil database.

    Is it possible to use PRADS yet as a PADS replacement in combination with sguil yet? I’m trying to build a proper Gentoo ebuild for some time now, but PADS is still not working as it should.



  2. erwinpdev says:

    After my previous comment I also tested the git version of PADS. This version also crashes on hardened gentoo (64 bit) with the following error message:

    pads[9006]: segfault at ffffffff934fa340 ip 0000681423ecb391 sp 000075233d4b57a8 error 4 in[681423e4f000+150000]
    grsec: From signal 11 sent to /tmp/pads-1.2-sguil-mods/src/pads[pads:9006] uid/euid:103/103 gid/egid:1006/1006, parent /bin/bash[bash:32762] uid/euid:0/0 gid/egid:0/0

    The original version of PADS in SVN ( does not crash, but is properly missing the patches needed for Sguil.

    Any idea how to fix this?


  3. Erwin,

    To properly diagnose your problem, I would need some more info from you.

    I would compile pads like this:
    export LDFLAGS=”-ggdb”
    ./configure; make
    ulimit -c unlimited

    and then run pads.

    Email me personally with your findings 🙂


  4. John says:

    I downloaded your patched pads from github and compiled it on FreeBSD 8 i386. I got this error.
    Please advise.

    gcc -DHAVE_CONFIG_H -I. -I. -I../.. -I../.. -I../../src -I../../lib -I/usr/local/include -g -O2 -c output-fifo.c
    output-fifo.c: In function ‘u_ntop’:
    output-fifo.c:272: error: ‘const struct in6_addr’ has no member named ‘s6_addr32’
    *** Error code 1

    Stop in /usr/local/src/pads-1.2-sguil-mods/src/output.
    *** Error code 1

    Stop in /usr/local/src/pads-1.2-sguil-mods/src.
    *** Error code 1


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s