# Unable to debug policies

**URL:** https://community.zeek.org/t/unable-to-debug-policies/1266
**Category:** Zeek
**Created:** [November 19, 2007, 11:45am UTC](https://community.zeek.org/t/unable-to-debug-policies/1266 "2007-11-19T11:45:15Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Fabian\_Hensel](https://avatars.discourse-cdn.com/v4/letter/f/aeb1de/32.png) [@Fabian\_Hensel](https://community.zeek.org/u/Fabian_Hensel)
#### Post date: [November 19, 2007, 11:45am UTC](https://community.zeek.org/t/unable-to-debug-policies/1266/1 "2007-11-19T11:45:15Z")

</div>

Hi

I am trying to debug policy files with the -d parameter (version  
1.3.2). When I try to enter any debug command ("b  
connection\_established" in the example), it gets misinterpreted and I  
get output similar to this:

root@idsvmifi:/home/irdeto98/bro-1.3.2/out# bin/bro -i eth0 -d brolite  
Policy file debugging ON.  
listening on eth0  
In bro\_init() at policy/pcap.bro:99  
99 update\_default\_pcap\_filter();  
(Bro [0]) b connection\_established  
Breakpoint 1 set at policy/pcap.bro:99  
Ambiguous command; could be  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;continue  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cond  
No Matching command for 'nn'.  
No Matching command for 'ec'.  
No Matching command for 'ti'.  
No Matching command for 'on'.  
No Matching command for '\_e'.  
In update\_default\_pcap\_filter() at policy/pcap.bro:86  
86 default\_pcap\_filter = build\_default\_pcap\_filter();  
No Matching command for 'ab'.  
82 global default\_pcap\_filter = "\<not set\>";  
83  
84 function update\_default\_pcap\_filter()  
85 {  
86 default\_pcap\_filter = build\_default\_pcap\_filter();  
87  
88 if ( ! precompile\_pcap\_filter(DefaultPcapFilter,  
default\_pcap\_filter) )  
89 {  
90 print fmt("can't compile filter %s",  
default\_pcap\_filter);  
91 exit();  
No Matching command for 'sh'.  
No Matching command for 'ed'.  
Ambiguous command; could be  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;help  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;quit  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;next  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;s  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;c  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;finish  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;b  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cond  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;d  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;clear  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;dis  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;enable  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ignore  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;set  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;where  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;frame  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;up  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;down  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;info  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;l  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;display  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;undisplay  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;trace  
(Bro [1]) (Bro [2]) (Bro [3]) (Bro [4]) (Bro [5]) (Bro [6]) (Bro [7])  
(Bro [8]) (Bro [9]) (Bro [10]) (Bro [11]) (Bro [12]) (Bro [13])

Running on Ubuntu 7.10. Anyone have an idea what is wrong? My  
suspicion is something with termcap/ncurses...

Regards - Fabian

---

<div class="post-metadata">

### Author: ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)
#### Post date: [November 27, 2007, 2:17am UTC](https://community.zeek.org/t/unable-to-debug-policies/1266/2 "2007-11-27T02:17:46Z")

</div>

> (Bro [0]) b connection\_established  
> Breakpoint 1 set at policy/pcap.bro:99  
> Ambiguous command; could be  
> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;continue  
> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cond  
> No Matching command for 'nn'.  
> No Matching command for 'ec'.  
> No Matching command for 'ti'.  
> No Matching command for 'on'.

This indeed looks familiar (though doesn't reproduce for me running  
on MacOS 10.4).

> Running on Ubuntu 7.10. Anyone have an idea what is wrong? My  
> suspicion is something with termcap/ncurses...

I suspect you're right. Can you send us your config.log as a starting  
point?

&nbsp;&nbsp;&nbsp;&nbsp;Vern

---

<div class="post-metadata">

### Author: ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/unable-to-debug-policies/1266/3 "2022-05-06T15:38:25Z")

</div>