[Snort-devel] Whee, Coredump
erek at ...835...
Sat May 31 06:56:02 EDT 2003
On Sat, 31 May 2003, Roy S. Rapoport wrote:
> Been working on getting SnortCenter to play nice with Snort 2.0. At
> this point, SnortCenter has managed to create a config file for snort
> that causes it to segfault and dump core. I'm guessing this is
> unexpectedly bad.
> The config file is about 500K, so I figured it'd be impolite to mail it.
> It's available at http://www.inorganic.org/~rsr/bad_snort_config.txt
Ok maybe I'm just a bit crazy, but _why_ would you ever need a config file
of that size? I know it's not you, I understand the program does that,
but I'd like to know WHY. It just doesn't make any sense to me... I
mean, snort.conf is _DESIGNED_ to be modular!
On to the problem. Rebuild snort with --enable-debug. That wil give you
a binary that's debug enabled and unstripped. Once you get the core, a bt
would acutally have the info (function names and such) that's missing from
Ok, I'm going to get coffee now.
"When things get weird, the weird turn pro." H.S. Thompson
More information about the Snort-devel