Re: Enabling Debug option

[Russ Combs <rcombs () sourcefire com>]

On Wed, May 22, 2013 at 4:04 PM, Mohamed Makthum <makthum () gmail com> wrote:
> Hello Everyone,
>
>                                 I am trying to test arpspoof preprocessor
> but it isn’t working. The preprocessor isn’t generating any alert msgs when
> arp replies spoofed. Kindly let me know how can I know whether particular
> preprocessor is initialized or not . How do I debug ?

spp_arpspoof.c is only using DEBUG_PLUGIN and DEBUG_INIT so you could:

export SNORT_DEBUG=0x21

to get those messages.  However, I suggest breaking on ARPspoofInit()
and DetectARPattacks() and stepping through the code instead.
> I have made a build using –enable-debug option. I have read several
> questions where it is mentioned to use export env variable SNORT_DEBUG but I
> am not sure what value to specify for the variable.
>
>
>
> I have also modified snort.conf to enable the preprocessor. Kindly help me
> to enable debugging.
>
>
>
>
>
> Regards,
>
> Mohamed Makthum Mohamed
>
> Grad student
>
>
> ------------------------------------------------------------------------------
> Try New Relic Now & We'll Send You this Cool Shirt
> New Relic is the only SaaS-based application performance monitoring service
> that delivers powerful full stack analytics. Optimize and monitor your
> browser, app, & servers with just a few lines of code. Try New Relic
> and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_may
> _______________________________________________
> Snort-devel mailing list
> Snort-devel () lists sourceforge net
> https://lists.sourceforge.net/lists/listinfo/snort-devel
> Archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel
>
> Please visit http://blog.snort.org for the latest news about Snort!

------------------------------------------------------------------------------
Try New Relic Now & We'll Send You this Cool Shirt
New Relic is the only SaaS-based application performance monitoring service 
that delivers powerful full stack analytics. Optimize and monitor your
browser, app, & servers with just a few lines of code. Try New Relic
and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_may
_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel
Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel

Please visit http://blog.snort.org for the latest news about Snort!