Home page logo
/

snort logo Snort mailing list archives

Re: Enabling Debug option
From: Russ Combs <rcombs () sourcefire com>
Date: Wed, 22 May 2013 23:43:14 -0400

On Wed, May 22, 2013 at 4:04 PM, Mohamed Makthum <makthum () gmail com> wrote:
Hello Everyone,

                                I am trying to test arpspoof preprocessor
but it isn’t working. The preprocessor isn’t generating any alert msgs when
arp replies spoofed. Kindly let me know how can I know whether particular
preprocessor is initialized or not . How do I debug ?

spp_arpspoof.c is only using DEBUG_PLUGIN and DEBUG_INIT so you could:

export SNORT_DEBUG=0x21

to get those messages.  However, I suggest breaking on ARPspoofInit()
and DetectARPattacks() and stepping through the code instead.



I have made a build using –enable-debug option. I have read several
questions where it is mentioned to use export env variable SNORT_DEBUG but I
am not sure what value to specify for the variable.



I have also modified snort.conf to enable the preprocessor. Kindly help me
to enable debugging.





Regards,

Mohamed Makthum Mohamed

Grad student


------------------------------------------------------------------------------
Try New Relic Now & We'll Send You this Cool Shirt
New Relic is the only SaaS-based application performance monitoring service
that delivers powerful full stack analytics. Optimize and monitor your
browser, app, & servers with just a few lines of code. Try New Relic
and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_may
_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel
Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel

Please visit http://blog.snort.org for the latest news about Snort!

------------------------------------------------------------------------------
Try New Relic Now & We'll Send You this Cool Shirt
New Relic is the only SaaS-based application performance monitoring service 
that delivers powerful full stack analytics. Optimize and monitor your
browser, app, & servers with just a few lines of code. Try New Relic
and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_may
_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel
Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel

Please visit http://blog.snort.org for the latest news about Snort!


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]