[Snort-devel] Whee, Coredump

Erek Adams erek at ...835...
Sat May 31 06:56:02 EDT 2003


On Sat, 31 May 2003, Roy S. Rapoport wrote:

> Been working on getting SnortCenter to play nice with Snort 2.0.  At
> this point, SnortCenter has managed to create a config file for snort
> that causes it to segfault and dump core.  I'm guessing this is
> unexpectedly bad.
>
> The config file is about 500K, so I figured it'd be impolite to mail it.
> It's available at http://www.inorganic.org/~rsr/bad_snort_config.txt

[...snip...]

Ok maybe I'm just a bit crazy, but _why_ would you ever need a config file
of that size?  I know it's not you, I understand the program does that,
but I'd like to know WHY.  It just doesn't make any sense to me...  I
mean, snort.conf is _DESIGNED_ to be modular!

</coffeeless_rant>

On to the problem.  Rebuild snort with --enable-debug.  That wil give you
a binary that's debug enabled and unstripped.  Once you get the core, a bt
would acutally have the info (function names and such) that's missing from
your bt.

Ok, I'm going to get coffee now.

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson




More information about the Snort-devel mailing list