Snort mailing list archives
Strange system() problem with snort
From: "Mark Wormgoor" <mark () wormgoor com>
Date: Sun, 30 Dec 2001 10:59:52 +0100
Guys, I have a small problem with starting snort from another program. I'm running snort 1.8.3 (from RPM) on a Redhat 7.2 based system. When I start snort from the command line, it will start just fine: /usr/sbin/snort -c /etc/snort/snort.conf -D -u snort -g snort -d -e -z ALL -A fast -m 022 -i ppp0 Dec 30 09:51:42 ipcop kernel: device ppp0 entered promiscuous mode Dec 30 09:51:42 ipcop snort: PID stat checked out ok, PID set to /var/run/ Dec 30 09:51:42 ipcop snort: Writing PID file to "/var/run/" Dec 30 09:51:42 ipcop snort: Initializing daemon mode Dec 30 09:51:42 ipcop snort: PID stat checked out ok, PID set to /var/run/ Dec 30 09:51:42 ipcop snort: Writing PID file to "/var/run/" Dec 30 09:51:42 ipcop snort: There's no second layer header available for this datalink Dec 30 09:51:47 ipcop snort: Snort initialization completed successfully, Snort running When I start snort from another program, it dies. The important line here is 'device ppp0 left promiscuous mode'. Why is it leaving promiscuous mode so soon after I start it? system("/usr/sbin/snort -c /etc/snort/snort.conf -D -u snort -g snort -d -e -z ALL -A fast -m 022 -i ppp0"); Dec 30 09:51:17 ipcop kernel: device ppp0 entered promiscuous mode Dec 30 09:51:17 ipcop snort: PID stat checked out ok, PID set to /var/run/ Dec 30 09:51:18 ipcop snort: Writing PID file to "/var/run/" Dec 30 09:51:18 ipcop snort: Initializing daemon mode Dec 30 09:51:18 ipcop kernel: device ppp0 left promiscuous mode Dec 30 09:51:18 ipcop snort: PID stat checked out ok, PID set to /var/run/ Dec 30 09:51:18 ipcop snort: Writing PID file to "/var/run/" Dec 30 09:51:18 ipcop snort: There's no second layer header available for this datalink Dec 30 09:51:23 ipcop snort: Snort initialization completed successfully, Snort running Dec 30 09:51:23 ipcop snort: pcap_loop: recvfrom: Socket operation on non-socket Dec 30 09:51:23 ipcop snort: Snort received signal 3, exiting Kind regards, Mark Wormgoor *************************************************************** * |\ /| | /| / Mark Wormgoor * * | \ / | | / | / mailto:mark () wormgoor com * * | \/ |ark |/ |/ormgoor http://www.wormgoor.com/mark/ * *************************************************************** _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Strange system() problem with snort Mark Wormgoor (Dec 30)
- Re: Strange system() problem with snort John Sage (Dec 30)
- Re: Strange system() problem with snort Mark Wormgoor (Dec 30)
- Re: Strange system() problem with snort John Sage (Dec 30)