Find the answer to your Linux question:
Results 1 to 3 of 3
Enjoy an ad free experience by logging in. Not a member yet? Register.
  1. #1

    snort mstring.c undefined instruction

    hey experts,

    i crosscompiled snort for a system with arm architecture. compiling and installing finished succesfully.
    running snort from embedded system stops with the following msg:

    Portscan Detection Config:
    Detect Protocols: TCP UDP ICMP IP
    Detect Scan Type: portscan portsweep decoy_portscan distributed_portscan
    Sensitivity Level: Low
    Memcap (in bytes): 10000000
    Number of Nodes: 36900

    Tagged Packet Limit: 256
    snort (85): undefined instruction: pc=00010e38
    Code: e24cb004 e24dd018 e50b0010 e51b3010 (ee013190)
    Illegal instruction

    the number behind "snort" increases each time i run snort.

    after that i compiled snort with the debug option and ran it again with debug_all. the following appears.

    mstring.c:191: max_strs = 1 curr_str = 1
    mstring.c:199: Checking if curr_str (1) >= max_strs (1)
    mstring.c:215: Finishing up...
    mstring.c:215: Allocating 10 bytes for last token mstring.c:225: tok[1]: reference
    mstsnort (255): undefined instruction: pc=00012d10
    ring.c:232: max_strs = 1 curr_str = 1
    mstring.c:232: mSplit goCode: t 2 tokens!
    mstring.c:125:[*] Splitting string: url htt pe24cb004 ://
    mstring.c:125: curr_str = 0
    mstring.c:152: max_strs = 1 ce24dd018 urr_str = 0
    mstring.c:171: Allocating 4 bytes for token mstringe50b0010 .c:182: tok[0]: url
    mstring.c:191: curr_str = 1
    mstring.c:191:e51b3010 max_strs = 1 curr_str = 1
    mstring.c:199: Checking if curr_str(ee013190) (1) >= max_strs (1)
    mstring.c:215: Finishing up...
    215: Allocating 8 bytes for last token mstring.c:225: tok[1]: h ttp://
    mstring.c:232: max_strs = 1 curr_str = 1
    mstring.c:232: mSplit got 2 tokens!
    Tagged Packet Limit: 256
    Illegal instruction

    as you can see "the undefined instruction" appears also. but each time i run it the "undefined instruction" is in another line.
    i opened the mstring.c an went to line 232, but my C knowledge is very rudimental and i cant figure at whats happening Sad

    so, any ideas?

    thx a lot


  2. #2
    Linux Guru Rubberman's Avatar
    Join Date
    Apr 2009
    I can be found either 40 miles west of Chicago, in Chicago, or in a galaxy far, far away.
    Can you post mstring.c here? Without looking at the source you are using, I cannot speculate what the problem might be. It could be a compiler error, FWIW.
    Sometimes, real fast is almost as good as real time.
    Just remember, Semper Gumbi - always be flexible!

  3. #3
    i actually know the problem. the kernel for the embedded system wasnt compiled with math emulation (nwfpe or fastfpe) .. so snort is using floating point operation which the kernel cannot handle with.

  4. $spacer_open

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts