next up previous
Next: 8 Miscellaneous Up: The Snort FAQ Previous: 6 Problems

Subsections

7 Development

7.1 How do you put Snort in debug mode?

In Snort 1.9 or higher,

  1. ./configure -enable-debug
  2. Look up the section of Snort you'd like to debug ( look at src/snort.h ) and add up the contants.

    For example,

    #define DEBUG_PORTSCAN2       0x00080000  /* 524288 / (+ conv2 ) 589824 */
    

    To debug both just portscan2,

    export SNORT_DEBUG=524288
    

    To debug both portscan2 and conversation:

    export SNORT_DEBUG=589824
    

  3. Run snort as normal. You will need to redirect output to a file to cope with the large amounts of debug output.



2005-03-21