{"action":"created","issue":{"url":"https://api.github.com/repos/cuckoosandbox/cuckoo/issues/1100","repository_url":"https://api.github.com/repos/cuckoosandbox/cuckoo","labels_url":"https://api.github.com/repos/cuckoosandbox/cuckoo/issues/1100/labels{/name}","comments_url":"https://api.github.com/repos/cuckoosandbox/cuckoo/issues/1100/comments","events_url":"https://api.github.com/repos/cuckoosandbox/cuckoo/issues/1100/events","html_url":"https://github.com/cuckoosandbox/cuckoo/pull/1100","id":178032621,"number":1100,"title":"Fix agent.py timeout error caused by tcpdump process.","user":{"login":"consen","id":2787272,"avatar_url":"https://avatars.githubusercontent.com/u/2787272?v=3","gravatar_id":"","url":"https://api.github.com/users/consen","html_url":"https://github.com/consen","followers_url":"https://api.github.com/users/consen/followers","following_url":"https://api.github.com/users/consen/following{/other_user}","gists_url":"https://api.github.com/users/consen/gists{/gist_id}","starred_url":"https://api.github.com/users/consen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/consen/subscriptions","organizations_url":"https://api.github.com/users/consen/orgs","repos_url":"https://api.github.com/users/consen/repos","events_url":"https://api.github.com/users/consen/events{/privacy}","received_events_url":"https://api.github.com/users/consen/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-09-20T11:18:55Z","updated_at":"2016-09-20T11:26:19Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/cuckoosandbox/cuckoo/pulls/1100","html_url":"https://github.com/cuckoosandbox/cuckoo/pull/1100","diff_url":"https://github.com/cuckoosandbox/cuckoo/pull/1100.diff","patch_url":"https://github.com/cuckoosandbox/cuckoo/pull/1100.patch"},"body":"When I ran cuckoo, encountered many time out error:\r\n\r\n```\r\n2016-09-20 14:04:27,790 [lib.cuckoo.core.guest] DEBUG: vm-117: error retrieving status: timed out\r\n2016-09-20 14:04:28,799 [lib.cuckoo.core.scheduler] ERROR: The analysis hit the critical timeout, terminating.\r\n```\r\n\r\n```\r\n2016-09-20 14:08:58,540 [lib.cuckoo.core.scheduler] ERROR: vm-111: the guest initialization hit the critical timeout, analysis aborted.\r\n```\r\nFinally I found it's caused by tcpdump process, which inherits parent process's opened connections:\r\n\r\n```\r\ntcp      259      0 192.168.56.1:44116            192.168.56.106:8000           CLOSE_WAIT  24558/tcpdump       \r\ntcp        0      0 192.168.56.1:50038            192.168.56.113:8000           ESTABLISHED 24356/tcpdump\r\n```\r\n\r\nSet `closed_fds` to`Ture`, cuckoo works well."},"comment":{"url":"https://api.github.com/repos/cuckoosandbox/cuckoo/issues/comments/248274523","html_url":"https://github.com/cuckoosandbox/cuckoo/pull/1100#issuecomment-248274523","issue_url":"https://api.github.com/repos/cuckoosandbox/cuckoo/issues/1100","id":248274523,"user":{"login":"jbremer","id":1148773,"avatar_url":"https://avatars.githubusercontent.com/u/1148773?v=3","gravatar_id":"","url":"https://api.github.com/users/jbremer","html_url":"https://github.com/jbremer","followers_url":"https://api.github.com/users/jbremer/followers","following_url":"https://api.github.com/users/jbremer/following{/other_user}","gists_url":"https://api.github.com/users/jbremer/gists{/gist_id}","starred_url":"https://api.github.com/users/jbremer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jbremer/subscriptions","organizations_url":"https://api.github.com/users/jbremer/orgs","repos_url":"https://api.github.com/users/jbremer/repos","events_url":"https://api.github.com/users/jbremer/events{/privacy}","received_events_url":"https://api.github.com/users/jbremer/received_events","type":"User","site_admin":false},"created_at":"2016-09-20T11:26:19Z","updated_at":"2016-09-20T11:26:19Z","body":"Interesting! I'm wondering what would be the best way to unittest this. Also note that `close_fds` does not exist on Windows-based platforms (for the host), so we'll be needing special handling there (same goes for `close_fds` usage in the VirtualBox machinery module)."}}
{"actor":{"display_login":"jbremer"}}