To run unittests from the build directory:
./src/suricata -u -l /tmp/
The -l option is added to overwrite the default log dir. Some tests write logs. This way we don't need root/sudo rights to complete the tests.
Running unittests with valgrind enabled:
valgrind -v --trace-children=yes ./src/suricata -u -l /tmp/
The trace children option is necessary if running from the build directory, as "src/suricata" is a script in that case. This is caused by us bundling the libhtp.
gdb with core files¶
If Suricata crashed with a core dump, lots of info can be retrieved from this core file.
gdb /path/to/suricata /path/to/core
Getting info about the traffic¶
For example, in a bt like this:
(gdb) bt #0 0x00007f0302c1af47 in ?? () from /lib/x86_64-linux-gnu/libc.so.6 #1 0x00007f0302c1917e in __assert_fail () from /lib/x86_64-linux-gnu/libc.so.6 #2 0x00000000005ac84d in StreamTcpReassembleAppLayer (tv=0x23258570, ra_ctx=0x7f02b8001540, ssn=0x7f027c72c9e0, stream=0x7f027c72ca30, p=0x25057a0) at stream-tcp-reassemble.c:2979 #3 0x0000000000000000 in ?? ()
You can get to the traffic into by going to a frame where you have the
"p" (Packet) variable. In this case frame 2:
(gdb) frame 2
There you can print the entire packet:
(gdb) print *p
Or just individual fields:
(gdp) print p->proto (gdp) print p->sp (gdp) print p->dp
Addresses are bit more involved:
(gdb) print p->src.address.address_un_data32 (gdb) print p->dst.address.address_un_data32
This gives you an unsigned int value, you'll have to convert that to the
dotted quad notation yourself.
(gdb) print p->src.address.address_un_data32 $2 = 721529024
Perl is helpful here:
$ perl -MSocket -e "print inet_ntoa(pack('V',721529024)) . \"\n\";" 192.168.1.43
For IPv6 you'll have to use:
(gdb) print p->src.address.address_un_data32 (gdb) print p->src.address.address_un_data32 (gdb) print p->src.address.address_un_data32 (gdb) print p->src.address.address_un_data32
To figure out whether it's 4 or 6, print:
(gdb) print p->src.family
Here 2 is IPv4, 10 is IPv6.
In general, the same is true for 'frames' where only the Flow can be accessed. This usually has 'f' or 'flow' as variable name.
(gdb) print *f
Like with the packet, the flow has proto, sp, dp, and src and dst fields.
The flow can be accessed from the packet as well, through p->flow.