Results 1 to 3 of 3
hey experts,
i crosscompiled snort for a system with arm architecture. compiling and installing finished succesfully.
running snort from embedded system stops with the following msg:
...
Portscan Detection Config:
...
- 05-25-2009 #1Just Joined!
- Join Date
- May 2009
- Posts
- 6
snort mstring.c undefined instruction
hey experts,
i crosscompiled snort for a system with arm architecture. compiling and installing finished succesfully.
running snort from embedded system stops with the following msg:
...
Portscan Detection Config:
Detect Protocols: TCP UDP ICMP IP
Detect Scan Type: portscan portsweep decoy_portscan distributed_portscan
Sensitivity Level: Low
Memcap (in bytes): 10000000
Number of Nodes: 36900
Tagged Packet Limit: 256
snort (85): undefined instruction: pc=00010e38
Code: e24cb004 e24dd018 e50b0010 e51b3010 (ee013190)
Illegal instruction
the number behind "snort" increases each time i run snort.
after that i compiled snort with the debug option and ran it again with debug_all. the following appears.
mstring.c:191: max_strs = 1 curr_str = 1
mstring.c:199: Checking if curr_str (1) >= max_strs (1)
mstring.c:215: Finishing up...
mstring.c:215: Allocating 10 bytes for last token mstring.c:225: tok[1]: reference
mstsnort (255): undefined instruction: pc=00012d10
ring.c:232: max_strs = 1 curr_str = 1
mstring.c:232: mSplit goCode: t 2 tokens!
mstring.c:125:[*] Splitting string: url htt pe24cb004 ://
mstring.c:125: curr_str = 0
mstring.c:152: max_strs = 1 ce24dd018 urr_str = 0
mstring.c:171: Allocating 4 bytes for token mstringe50b0010 .c:182: tok[0]: url
mstring.c:191: curr_str = 1
mstring.c:191:e51b3010 max_strs = 1 curr_str = 1
mstring.c:199: Checking if curr_str(ee013190) (1) >= max_strs (1)
mstring.c:215: Finishing up...
mstring.c:
215: Allocating 8 bytes for last token mstring.c:225: tok[1]: h ttp://
mstring.c:232: max_strs = 1 curr_str = 1
mstring.c:232: mSplit got 2 tokens!
Tagged Packet Limit: 256
Illegal instruction
as you can see "the undefined instruction" appears also. but each time i run it the "undefined instruction" is in another line.
i opened the mstring.c an went to line 232, but my C knowledge is very rudimental and i cant figure at whats happening Sad
so, any ideas?
thx a lot
topf
- 05-31-2009 #2Linux Guru
- Join Date
- Apr 2009
- Location
- I can be found either 40 miles west of Chicago, or in a galaxy far, far away.
- Posts
- 8,499
Can you post mstring.c here? Without looking at the source you are using, I cannot speculate what the problem might be. It could be a compiler error, FWIW.
Sometimes, real fast is almost as good as real time.
Just remember, Semper Gumbi - always be flexible!
- 06-02-2009 #3Just Joined!
- Join Date
- May 2009
- Posts
- 6
i actually know the problem. the kernel for the embedded system wasnt compiled with math emulation (nwfpe or fastfpe) .. so snort is using floating point operation which the kernel cannot handle with.


Reply With Quote
